Opinion - Blogs and wikis could blow the gaffe on you. You need to educate users and win their buy-in if you want to safeguard all the sensitive or confidential information in your organisation, argues David Tebbutt.

In all the breathless talk about new media, and I'm as guilty as anyone, little mention is made of regulatory and legal compliance. If wikis are used by a closed community or blogs made inaccessible to all but the cognoscenti, should participants be able to discuss whatever they like?

Suppose a company needed to restructure, would it be wise to let HR managers in different locations share their views through a wiki? If a researcher made some fantastic and potentially very profitable discovery, should they discuss it with colleagues in instant messaging conversations? If a team blogger wanted to comment on a particular member of the night shift, would that be okay?

You might think membership of a closed group protects you and your scribblings - you are not, after all, part of the formal records management system of the organisation. Don't you believe it. Regulators, law enforcers or, if you're a public body, anyone off the street can demand a copy of your supposedly confidential exchanges.

This may not happen unless your organisation falls foul of some law or regulation. But once it does, the authorities can see all the records.

In a conventional records management system, retention schedules ensure that electronic material has a life cycle, including disposal. In a blog, this is just about unheard of. Part of its value is that, in order to protect the integrity of inbound links, material is rarely deleted.

A wiki could be destroyed once the outcome has been published to the formal system, but this would mean jettisoning huge amounts of potentially useful information. Instant messages are less of a problem - they either go unrecorded or older messages can be purged.

But Butler Group's ...