HR and Legal, on the same record

A held record is excluded from routine retention purges. It is a deliberate act by a person, recorded with why and when — never a standing carve-out that quietly exempts a whole table from anyone's right to erasure. And an erasure request against a held record stops and asks a human, because that is a decision for counsel and not for a script.

Once a file is under hold, every read is recorded — who, when, and the grant that let them in, captured as a snapshot that outlives their account. "Nobody looked at this for six weeks" and "three managers read it the same afternoon" are both answers somebody will want, and neither survives in a system that only logs edits.

Where an incident does raise a conduct question, it becomes an HR record that carries the incident as its source — filed as an allegation, with no finding written, and with the staff member's right to respond intact. Provenance is kept without the disciplinary file inheriting the incident's audience, or the incident inheriting HR's conclusions.

Each affected person is linked to the specific signed document and signature row, not to whatever the waiver says today. A form gets revised; the record has to produce the terms that person agreed to on the day, which is a different document and often a materially different one.