Managing text messages as business records

When you send or receive a text or short message service (SMS) message for work purposes, it is a State record. This means it must be captured, maintained and disposed of in accordance with the State Records Act 1998.

You can dispose of text messages under certain conditions

Part 8 of the State Records Regulation 2024 prescribes guidelines on when you can destroy SMS messages as a normal administrative practice. You cannot destroy messages that have continuing value, which means records that have administrative, business, fiscal, legal, evidential or historic value to the public office. You must assess continuing value based on the information contained in the text message and the context in which it was sent or received, and not on the format of the record itself.

If a text message does not have continuing value, or if its contents are ephemeral, then you can generally destroy it as a normal administrative practice.

You should have a policy on text messages

To ensure consistency within your organisation, you should have an organisation-wide policy or guideline that outlines the types of text messages that need to be captured into a corporate recordkeeping system. This could be included in your policy on mobile device use or on normal administrative practice, or it could be a standalone document.

It should:

• describe when text messaging can be used for work purposes
• define the types of text messages you consider to be ephemeral and that do not need to be captured into a corporate recordkeeping system
• define the types of text messages that you must capture into a corporate recordkeeping system, and
• outline how you capture a text message into your corporate recordkeeping system.

Consider whether you should rely on text messaging for official business

Text messages are convenient, fast and widely used. Using text messages for facilitative communications, such as letting a colleague know that you are running five minutes late, is generally fine. However, for more important communications you should consider whether it is appropriate to rely on texting alone. For high risk business, the limitations of relying on text messages may be unacceptable for your organisation’s recordkeeping and accountability requirements.

Sending an email makes it easier to demonstrate the authenticity of the message and is more accountable. You can send the email first, and follow up with a text message to remind the recipient to check their email, or you can send the text message first, and follow up with an email after.

Email automatically contains important metadata, and common email platforms are more readily integrated with corporate recordkeeping systems. You can also access email from most smart mobile devices. Screenshots of text messages often do not contain sufficient metadata to confirm the authenticity of the text message as a record.

Capturing text messages as records

There are many different ways to capture a record of a text message into your corporate recordkeeping system. To determine the way that best suits your needs, consider:

• the risk and importance of the business you are conducting through text messaging
• the types of mobile devices you are using, and
• your capability to deploy and manage technical solutions.

A record of a text message should include:

• the content of the text message
• who sent and received the text message
• the time and date the text message was sent or received, and
• any other metadata that is needed for your business.

See the table below for examples of methods for capturing text messages as records.

These methods will vary in how robust they are in terms of recordkeeping requirements. If you are relying on text messages for business that has a high level of risk, for example authorising someone to proceed with a significant decision, you need to take a proportionately rigorous approach to ensure that your evidence of an approval is an authoritative and trustworthy record.

Limitations of text messages as records of continuing value

There are risks to relying on text messages as evidence of your business, even when they are captured into your corporate recordkeeping system.

Text messaging is not necessarily secure

There may be instances where you are not able to verify the identity of the sender or receiver. It may also create privacy issues if third parties are able to read messages not intended for them.

It can be difficult to capture context

Due to the brief nature of text messages, a single message may not provide the full context of the information that is being conveyed. Depending on the method you use to capture text messages, it can be difficult or inefficient to capture the full thread of a conversation.

Other types of messaging

The State Records Regulation 2024 covers a range of message types in addition to SMS messages. If you are using instant messaging or messaging applications such as WhatsApp for work purposes, you must also consider your recordkeeping obligations.

Published 2016