Preparing for the Evolving Risk of Private Copies and The IGRM 4.1

Employees’ private copies of work files present a specific governance challenge. Privacy risk is growing due to unofficial and duplicated information scattered throughout an organization, writes Sheila Grela of EDRM. 

The updated Information Governance Reference Model (IGRM) 4.1 reevaluates how organizations address information governance, privacy, and operational risk.  It recommends governance practices that align with how information migrates beyond formal systems into everyday workflows. 

Grela acknowledges that private copies are unofficial versions of information created in the course of routine work, such as files saved on laptops, email attachments, shared documents, and copies stored on collaboration platforms. Although these copies support day-to-day productivity, they frequently exist outside established governance controls. As a result, organizations face a widening gap between documented information management policies and everyday operational practices.

The updated IGRM recognizes that information routinely moves across users, devices, and platforms throughout its lifecycle. This evolution highlights the need for governance frameworks that address the realities of information creation, retention, and transfer across the organization. It reinforces the importance of integrating privacy considerations into broader information governance strategies rather than relying solely on technical safeguards.

Grela outlines the operational consequences of unmanaged copies. Duplicated information complicates data minimization efforts, disrupts retention and lifecycle management, increases the complexity of eDiscovery and regulatory responses, and expands the scope of potential data breaches. Because employees routinely create and distribute information outside managed environments, technology alone cannot eliminate these risks. Instead, effective governance depends on coordination among legal, privacy, information technology, and records management functions.

To address the governance challenge of private copies, organizations should focus on reducing unnecessary duplication, understanding how information flows through everyday workflows, and aligning governance practices with operational realities. As regulators and courts place greater emphasis on accountability, organizations that adapt their information governance programs to reflect the complete lifecycle of information will be better positioned to demonstrate compliance and manage privacy risk.