Information Governance Insights:
Should Old Acquaintance Be Forgot?
A new year means new beginnings and for the Information Governance Professional, it’s no different. It’s also time to get rid of your old files. This is the time of year when most organizations purge their archives of files that have reached their retention date. Many organizations prefer to use the generic month of January as a default disposition date for all records that can be disposed of in a given year, basically to get it over with. Regardless of when you do it, the important thing is that you follow the Retention Schedule and the Disposition process.
If it is not under a legal hold, get rid of it! Follow those workflows, get the approvals and dispose of those old files. Not only will this will save storage cost, but it will also minimize any risk associated with these old files. Remember to follow the rules of your documented policy, and be able to prove it, or you are better off without one. I highly recommend using an outside vendor to fulfill the disposal process. This is not something you should do yourself even if you have a great shredder in house.
A professional service has the equipment and processes to not only shred your old files, but they can pulp the shredded material into oblivion and recycle the byproduct so that nobody will ever know what those files were to begin with! Most importantly the disposal vendor can provide you with a Letter of Destruction so that you can prove the files have been responsibly dealt with.
The key word here is “expunged”. Complete and irretrievable.
From time to time you may come up against a file type that needs to be kept past the stated retention date for some reason other than a legal hold. In this case, you can have an Administrative Hold to review the change in retention period and adjust accordingly. This is not something to be done lightly. Although the retention period does have a legal or regulatory requirement, the administrative component is largely up to the individual organization. It is a best practice to make the changing of a retention period a very rigorous process to show due diligence in your process should it ever be reviewed for consistency.
That covers the hard copy that crowds up everyone’s storage areas, but what about the electronic side? These files need to be disposed of just as responsibly. A good example is backup tapes. Chances are very good that the backup tapes that you are using for disaster recovery are still being rotated out on some regular schedule. Part of that process will involve degaussing or “wiping” the old data off the tape before it is used again. This is good to a point, but technology has improved so that there is an ability to reconstruct this data. “Delete” does necessarily mean permanently removed. If your organization still uses a backup tape system you should consider destroying them periodically just like you do with hardcopy. Have your disposal vendor shred this equipment as well!
Now if your organization is like most, you also have a number of contracted Software as a Service (SaaS) systems or Cloud storage for a lot of your data too. This data needs to follow your retention schedule just like everything else. In this case, you have to do your homework up front in your procurement process to ensure the vendor can fulfill your needs. Make sure there is a disposition process included in the contract so that you can prove your data is actually gone when you stipulate it must be removed. The key word here is “expunged”. Complete and irretrievable. This should also be the case if you decide at some future date to move your data to another cloud vendor. Your data is yours and it is important that the cloud vendor treats it as such.
The more things change, the more they stay the same. It will always be important to clear out the old files to make room for the new. In today’s world, there is just a lot more of it. Have a process in place to ensure you are covering all of it. Happy New Year!
CAREER ADVICE
GOV TALK
