Data Retention and Destruction Policy

Introduction

The best practice to manage data in an organization is creating and implementing a data retention and destruction policy. Over the years, a business collects vast amounts of data about its customers, clients, and entities who interact with the organization. This information gathering happens through website forms, subscription-based services, or hard copy application documents. To maintain smooth business operations and regulatory compliance, the business needs to continuously update, remove, and systematically classify data. A data retention and destruction policy template provide guidelines for managing Personal Identifiable Information (PII).

A PII data retention and disposal policy covers personal identification information such as:

Social Insurance Number (SIN) (or the equivalent number for people outside Canada)
Tax ID or the equivalent ID outside Canada
Dates of Birth
License numbers
Full names and contact information, e.g., email addresses, post office addresses
National ID or passport number
National ID or passport number

What is a Data Retention and Destruction Policy?

Data retention is the practice of storing documents, records, and various data types for a specific period. On the other hand, data destruction is the process of sorting and shredding data that’s no longer useful to an organization.

Data retention policy is a set of written principles that guide how a company, employees, and parties interact with the business handle personal information. Data retention and destruction policy principles determine what and how data is captured, stored, or removed. A data retention and destruction policy template determines the data retention period and what happens to that data after the retention period expires.

Automation of data retention and destruction ensures you avoid having to sort large amounts of data physically. IT companies such as IBM, Oracle, and Microsoft have created data management systems that collect, sort, archive, and delete your data based on commands you input.

Why is a Data Retention and Destruction Policy Important?

A data retention and destruction policy facilitates the transparent management of a company’s data. It also helps a company comply with state and federal government regulations. The government is keen on implementing data security legislation, and it’s best practice for companies to apply regulations to their operations.

Data retention and destruction policies protect a company from lawsuits and penalties that can prove costly to a business due to fines and surcharges for not complying with the law. Depending on the industry, fines can run into millions of dollars due to the sensitivity of data.

What Does a Data Retention and Destruction Policy Include?

An effective data retention and destruction policy should first define its purpose, define the stakeholders it applies to, outline the regulations that guide the policy, and define the scope of data the policy affects.

The policy should also include the data retention period, what happens after the retention period, how data will be archived or destroyed, and the destruction methods to be applied.

Next, the policy should outline the rules for protecting data, who has access to different levels of data, and what happens when there’s a data breach.

Data auditing is also a vital component of a data retention and destruction policy. The policy should outline how often data systems should be audited to assess risks and loopholes.

In summary, a data retention and destruction policy template should outline:

The type of data to be retained.
How long the data will be retained.
What should be done to the data after the retention period expires, i.e., whether it should be archived or deleted.
What happens in the event of data breach and policy violation.
What happens in the event of data breach and policy violation.
The data destruction procedure.
What type of data destruction method to be applied.

Below are the types of data commonly captured in a data retention and destruction policy:

Communication between the business and its clients, employees, shareholders
Employee records
Customer records
Billing Information such as sales, invoices, receipts, orders
Contracts
Medical and healthcare data
Financial information – revenue, budgets, banking data, tax information
Supplier and vendor information
Documents and spreadsheets
The intellectual property of a company
Databases
Student information
Any other data collected by a business from its stakeholders

How to Create Data Retention Policy and Schedule

Creating a data retention policy requires involvement from all parties who hold and manage data within an organization. The policy creator conducts research to identify legislation, best practices, risks, and needs that need to be highlighted in the policy. Below are the key steps we recommend to create a data retention policy.

Create a team

This team will play an active role in creating the policy from start to approval. Ideally, the team should comprise staff from each department within the organization who can actively represent the department’s interests in policymaking.

Classify the data

Sort your data into categories according to how that data serves your organization. Take note of whether the data is permanent or temporary and the retention period attached to the data.

Identify laws and legislation that apply to the data

This requires thorough research to ensure the policy aligns with state and federal regulations. This stage also requires you to review contractual obligations that were agreed upon at the data collection point with your clients, customers, and stakeholders.

An example of legislation to consider while drafting your policy is the Personal Information Protection and Electronic Documents Act (PIPEDA) which dictates how personal information is collected and used in the course of commercial engagements.

Draft the policy

Consider the questions below as you put together the data retention and destruction policy:

How will laws and regulations be applied for each data category? Will you need legal advisers to guide you on this?
What is the legal stipulation for data involved in lawsuits, audits, or government review?
Who is responsible for data categories indicated in the policy?
How will the policy be enforced, and who will be in charge of ensuring enforcement?
How will each stage of policy drafting be communicated?
How will copies of documents be handled, and are they part of the policy?
Is there a data deletion clause for former employees and client records?
What is the data retention period, and how should the data be archived after the period ends?
How and when should the data be deleted?
Which data sets are temporary and are not dictated by the retention policy?
Which data is exempted from deletion?
What is the deletion and destruction method for each data category?
Is there a state-mandated data retention and disposal policy template, or will you create your own template?
How often will the policy be reviewed?

Communicate the new policy to all relevant stakeholders

Create copies of the policy and distribute them to each department. You can organize a meeting with all staff to explain the policy for better understanding. Create a policy implementation plan to roll out the policy across all departments and relevant stakeholders.

What is a Data Retention Period?

The data retention period is the duration of time that an organization stores various categories of data. The retention period will depend on the type of data, data retention laws, contractual obligations, and data sensitivity, among other factors.

The best practice for data retention is only to keep data when it’s useful. Once the data is no longer useful to the business’s objectives, data destruction/ data sanitization should be scheduled.

The National Institute for Standards and Technology (NIST) created guidelines for data sanitization that applies to all storage devices. The guidelines provide three effective data sanitization methods that protect data from unauthorized access: Clear, purge and destroy.

Clear

The clearing technique uses logical methods to sanitize data. Clearing provides a moderate level of data security by overwriting data in storage devices. This can be done by resetting storage devices to factory settings or overwriting with new data.

Purge

Purging data applies physical techniques or technology to render the data unreadable and unrecoverable even within a laboratory environment. Purging data is more effective than clearing and is ideal for handling sensitive data. This method applies techniques such as degaussing and cryptographic shredding to purge large data sets from storage systems.

Destroy

Destruction involves shredding data and destroying the storage devices as well. This method renders the data unrecoverable and the devices unusable. Techniques used to sanitize data through destruction include incineration, shredding, pulverization, and melting storage devices. Destruction is applied when storage devices are no longer useful and cannot be repaired. Though this method is effective in data sanitization, it is not the best alternative for the environment. The incineration needs to be done in an environmentally sound way to prevent soil, water, and air pollution.

Benefits of a Data Retention Policy

A well-functioning organization should have a data retention and destruction policy as part of its main data management practices. A data retention policy has a variety of benefits:

Free up storage space and create room

You free up storage space and create room for storing only relevant data. In addition, the policy ensures irrelevant data is removed with minimal disruption to business operations.

Knowing data

Knowing which data is should be archived protects vital IT assets that will be beneficial to future operations. The policy prevents the deletion of important data without prior review.

Data retention and destruction policy

A data retention and destruction policy protects the business from litigation in case of data leakages or hacking. In addition, knowing which laws and regulations apply to a data retention and destruction policy keeps you a step ahead of data security.

Employees access data

Employees access data easily and faster because only relevant information is retained.

Reduce the storage costs

Data retention and destruction policies improve data security and management in an organization.

Data retention and destruction policies