m preservation activities. Processing of personal information for 
maintenance or preservation purposes is different from the use of it for research or business 
purposes. Regardless of the legislative framework, the records creator should be able to 
demonstrate that processing of records containing personal information does not put such 
information at risk of unauthorized access. 
Responsibility for processing records containing personal data for maintenance and 
preservation purposes must reside with th