Effective Data Retention and Disposal Principles for Business Success

1. Principle 7: • Data Retention and Disposition • LEARNING OBJECTIVES: • Understand the importance of quality data retention • Understand the responsibilities of the Data Steward • Understand the considerations when reviewing data for continuing value • Understand how to decide when to archive data • Understand when data should be considered for refresh/migration • Understand the different methods to dispose of data • LEARNING OUTCOMES: • Student will be able to submit and review data for continuing value • Student will be able to determine when data should be archived • Student will be able to determine when data should be refreshed/migrated • Student will be able to correctly dispose of data

2. Terms and Definitions • Data retention — preservation, maintenance, and control of hard-copy and electronic data for future use or application • Data refresh/migration —periodic transfer of electronic data to updated configurations of hardware or software media to ensure that the media remains intact and the data can be retrieved and be usable • Disposal —deletion or destruction that results in the complete elimination of data from all storage media

3. Why Data Retention? • Value to the organization • Support to business decisions • Competitive advantage • Reduced waste for non-essential data storage Quality Data Retention Contributes to the Overall Business Value Stream

4. Retention Management and the Data Steward • Data stewards ensure: • Data with wide applicability are stored in an authorized, backed-up, and retrievable storage media • Planning is in place for data review and disposition • Inactive data are archived • Hard copies are protected • All data are currently indexed for retrievability Data Stewards Ensure Data Retention Works!

5. Create, index, Review data and adequately for continued back up data value Data retrievable? Assign retention review Author and primary No Destroy data in date based on stakeholders, legal, project accordance with contract/corporate/legal management, customer, etc., policies requirements value data? Yes Yes Data Review date Properly index, No properly indexed, reached? protect, and protected, and back up data backed up? No Yes Monitor for media refresh Yes Reset No requirements and Media outdated? retention refresh as review date necessary • Data Retention Decision Tree

6. Who Reviews the Data • Principle Stakeholder • Secondary Stakeholders • Legal • Program Management • Customers • Tax Consultants Stakeholder Involvement Increases Retention Effectiveness!

7. When to Review the Data • Organizational changes • Process transfer from one organization to another • Physical movement of repositories • Technological changes or reasons • Designated retention periods

8. How to Review the Data for Current Value • Data Assessments for current value should: • Validate the accuracy of the metadata • Analyze any security protections from unauthorized viewing • Analyze deterioration of data products • Analyze the value of migration • Ensure that the data repository has a secondary source Data reviews ensure valuable data are retrievable when needed!

9. How to Review the Data for Future Value • (I’m not sure how to present this concept – help?) • Assessing future value is somewhat more elusive. In some instances, data lose value with the passage of time. As examples, data of legal significance diminish significantly when the statute of limitations for filing suit passes. Data of point-in-time significance, for example, this month’s bank statement, may have little value beyond the upcoming month to one entity and tremendous significance to another party such as the Internal Revenue Service. Data generated by prominent people may enhance in value significantly over time.

10. Archive Preservation Process

11. Data Disposal • Maintain Records of Destruction! • Disposal Methods: • Paper • Non-sensitive – Trash System • Sensitive – Shredding or Burning • Digitized Paper – dispose of after thorough validation of digitization • Electronic Data • Non-sensitive – delete files • Sensitive – use disposal method as prescribed

12. Quiz Questions – P7 Which of the following statements best explains why an Enterprise should plan for data retention: a. Planning for data retention ensures appropriate funding is available for archiving when needed. b. Clearly defined methods for data retention help ensure that the data will be available when and if needed. c. Plans for data retention are needed to ensure facilities will be available to store data. d. It is important to plan for data retention to ensure tasking is assigned to the Data Manager. An essential element of preservation planning is to ensure planning for adequate protection of data against potential disaster commensurate with the age of the data. True or False Why is it important to use appropriate metadata when identifying retained data? a. To enable retrieval of those assets. b. To enable development of detailed reports. c. To enable timely destruction as appropriate. d. All of the above.

13. Quiz Questions – P7 Which of the following is not a method to ensure data assets are protected in an electronic environment? a. Segregation of data by server b. Padlock c. Firewall d. Password When evaluating the current and future value of data, some questions that may be asked are as follows: What data is currently stored and for what purpose? Is the data accurate and up-to-date? What are the criteria for the storage life of data? What are the costs associated with data retention? Will retaining the data enhance network security? Is there potential for this data to satisfy contractual or other legal requirements? True or False

14. Quiz Questions – P7 Once data is considered non-value, which of the following is true: a. The enterprise should arrange for disposal so that costly resources are not required to maintain non-value assets. b. A record should be retained to identify what documents were destroyed, when they were destroyed, and who authorized the destruction. c. Data assets of potential value to other parties should be destroyed in a way that prevents those assets from becoming publicly available. d. All of the above