Threat Tuesday: Do You Need a Data Retention Policy?

Your business produces thousands of documents each year. Some of them need to be kept for a certain amount of time, like financial statements, contracts, and regulatory documents. But other documents are only useful for a short period of time — like emails, presentations, and invoices.

But these documents can stick around for years and years, posing a legal and security risk to your business. A data retention policy can help you to clean up these files and documents, keeping your business protected.

What Is a Data Retention Policy?

A data retention policy is a business policy that specifies how long specific categories of documents are to be retained, after which they must be deleted or destroyed. For example, you may be required to keep financial records for seven years. So that would be spelled out in your data retention policy.

Other records, such as active business contracts, may need to be kept on hand for as long as they are current, and then destroyed after a set period of time.

After the retention period has elapsed, the expired documents are destroyed, and a certificate of destruction is issued. This applies to whether the documents were electronically deleted or physically shredded.

Why Do I Need a Data Retention Policy?

Data retention policies can protect your business from having too much data “on the loose”. First, if your company were to be involved in a lawsuit, any documents you have on hand could be legally discoverable. This means the other side gets to go through your documents, potentially helping their case and hurting yours.

Additionally, if you were to experience a data breach, a data retention policy could limit the amount of data exposed. Rather than having an unlimited supply of documents to leak, a retention policy will help to reduce that exposure.

Finally, many legal regulations like SOX and HIPAA specify data retention periods for covered entities. Formalizing a retention policy will help you to stay in compliance with these regulations.

How Do I Implement a Data Retention Policy?

A data retention policy is primarily a business decision, so you should create it with the help of your management team, along with input from a qualified legal professional. Once the policy has been created and approved, there are some technical controls that can simplify ongoing compliance with the policy. For example, email systems and document management systems may allow you to specify data retention policies, which will automatically delete documents after the specified retention period.

Also, partnering with a data destruction company can help you to adhere to your retention policy. CyberCrunch provides both paper document shredding and electronic data destruction. We can provide you with audit trails and certificates of destruction, simplifying your recordkeeping.