Name the decisions and their owners

Owner	Planning responsibility
Agency leadership and records officer	Confirm record series, custody, applicable disposition schedules and approval responsibilities.
Process owners	Explain how records are created, used, approved, retrieved and corrected.
Data Protection Officer	Review personal-data purposes, access, privacy risks, retention and service-provider arrangements.
IT and security	Assess authentication, integration, hosting, backup, recovery, monitoring and export requirements.
Procurement and legal teams	Review requirements, contract scope, applicable procurement rules and acceptance obligations.

1. Inventory the record series, not just the boxes

NAP’s inventory guidance provides the official context for cataloguing public records. Use the agency’s prescribed process and current NAP forms; the downloadable worksheet here is a preparation aid.

Identify the office, custodian, record-series title, purpose and business process.
Record date range, format, location and approximate volume; distinguish originals, copies and born-digital records.
Note which fields make a record retrievable, such as reference number, date, office and transaction type.
Identify personal or sensitive data, access restrictions and records needing special handling.
Record known gaps, duplicate collections and existing repositories without moving or destroying records.

Source: NAP General Circular No. 4 — Guidelines on National Inventory of Records

2. Record the authority behind each retention decision

Match each series to the applicable approved agency Records Disposition Schedule or General Records Disposition Schedule reference. Capture the retention trigger and periods rather than assigning one duration to every document.

Scanning is not permission to destroy the paper original. NAP guidance and Form No. 2 state that public-record disposal requires prior written authority from the NAP Executive Director. Use the current disposal procedure and check applicable legal, audit or investigation holds before taking any disposal step.

Capture the exact schedule, item number, approving authority and effective version.
Have the records officer resolve missing or conflicting schedule references before configuring deletion rules.
Document any hold, review date and person authorized to release it.
Keep retention, access restrictions and disposal approval as separate decisions.

Source: National Archives of the Philippines — Records Disposition Schedule, Form No. 2 · NAP General Circular No. 5 (2023) — Disposal of Valueless Records · National Archives of the Philippines — Frequently Asked Questions

3. Plan privacy and access before migration

NPC Circular 2023-06 addresses security of personal data in government and the private sector; it replaced Circular 16-01. Its requirements include privacy impact assessment, access controls and business continuity. Map the project to the applicable requirements with the DPO.

Document why personal data is processed and which roles need to view, change, approve, export or administer it.
Use representative, appropriately protected samples for evaluation; do not upload actual citizen or employee records through a public inquiry form.
Specify authentication, role approval, access reviews and removal when staff change roles or leave.
Identify provider responsibilities, service locations, incident arrangements and controls over subcontracted processing.

Source: NPC Circular 2023-06 — Security of Personal Data in the Government and the Private Sector · NPC announcement — Circular 2023-06 replaces Circular 16-01 · NPC — Implementing Rules and Regulations of the Data Privacy Act

4. Choose a pilot with observable acceptance tests

Pilot area	Example acceptance evidence to agree
Inventory and migration	Reconcile the source manifest with imported files and record every exception.
Document quality	Check a defined sample for completeness, orientation, readability and metadata accuracy.
Retrieval	Ask authorized users to find agreed sample records using real reference numbers and search terms.
Permissions	Show that an approved role can perform its task and a restricted role cannot access the same records.
Workflow	Demonstrate approval, delegation, return for correction and exception handling.
Recovery and exit	Demonstrate the agreed restore/export sample and document any limitations.

5. Make operations part of the plan

Assign an administrator and an alternate, with written operating instructions.
Agree backup ownership, restore-test responsibilities and a recovery exercise.
Identify who reviews access, import errors and workflow exceptions after go-live.
Agree the export deliverables, assistance and costs needed for a future transition.
Keep an issue register and obtain documented pilot acceptance before expanding scope.

Turn the checklist into a scoped planning engagement

A useful first engagement produces a records-inventory outline, a draft access matrix, a gap register and a phased pilot plan for one agreed office or record collection. It does not authorize disposal or determine a procurement award.

Sources and further reading

Content and sources checked 26 October 2026