Data Retention Policy

Document Legal and Business Requirements for Data Retention

The first step you should take when establishing a data retention plan is to identify any data security/privacy regulations that apply to your business. Common examples include the Payment Card Industry Data Security Standard (PCI DSS), the Health Insurance Portability and Accountability Act (HIPAA), and the European General Data Protection Regulations (EU GDPR).

Next, you should look at how your business uses data to support internal operational processes. At this stage, it’s vital to look across departments and think about what types of data each area of the business needs to achieve their goals. The key questions are:

• What data is being used?
• Who is using the data?
• How is the data being used?
• What access controls, availability, etc. are needed to support these applications?

Clearly defining your legal obligations and operational requirements with respect to data retention will help you organize a data retention plan that supports these critical objectives.

Inventory and Categorize Data

The next step you’ll want to take when creating a data retention policy is to conduct a thorough inventory of data generated and collected by your business. 

This includes all data from all departments and systems: sales data, marketing data, product usage data, customer and employee data, inventory data, transactional data, data from security and application logs, and the rest of it. 

Once you have a complete inventory of your data, you’ll want to sort the data into categories. You may want to categorize your data based on which department it came from, or which legal/regulatory or operational requirements apply to the data. When finished, you should be able to answer questions like:

• What are all of the data sources within our organization?
• What types of data are we collecting?
• Which types of data are covered by relevant legal/regulatory frameworks?
• Which types of data are needed to support business operations?

Identify Key Data Owners

As you create your data inventory in the previous step, it’s also important to start identifying key data owners within your organization.

Of course the business itself is the literal “owner” of the data - the data owners we’re talking about here are the departments, teams, or leaders who collect, use, and manage each type of data. Marketing data is usually controlled by leaders inside the marketing department, sales data is typically collected and used by sales managers, and data from cloud applications or services is usually controlled by IT.

Once you’ve identified the key data owners within your organization, you can work with those stakeholders to better understand their data needs - plus, you’ll know exactly who to contact when you need access.

Conduct a Business Impact Analysis

As you develop your data retention policy, it’s a great idea to conduct a Business Impact Analysis (BIA). 

The purpose of a BIA is to identify your organization’s most critical business activities, understand the potential impact of disruption to those activities, determine which data and resources are needed to support those activities, and establish both recovery time and recovery point objectives to ensure those data and resources remain available or can be recovered quickly in the event of a service outage.

Establish Data Retention Policies

At this point, you should know what data you have, who owns it, where the data is stored, and which data is essential for both legal/regulatory and operational purposes. As part of your BIA, you should have established recovery time and point targets for each type of data and analyzed the potential consequences of data loss/theft.

At this point, you should be ready to establish data retention policies. For each type of data you collect, you’ll want to document:

• Where the data will be stored,
• How long the data should be retained,
• What should happen to the data after the retention period (e.g. delete or archive)

Be sure to retain each type of data long enough to satisfy the legal and operational requirements identified earlier.

Establish Data Disposal Procedures

Many enterprises retain certain types of data for up to seven years, while other types of data may be retained for just a few days or weeks. Either way, it’s important to implement formalized procedures for deleting or archiving data following the planned retention period. 

In many cases, the process of deleting or archiving old data can be automated using specialized software tools or cloud services.

Establish a Disaster Recovery Plan

Even with the right data retention policies and procedures in place, there’s still the potential for a service outage or device failure to cause data loss that negatively impacts your legal compliance and/or operational objectives.

To avoid unacceptable negative consequences of data loss, you’ll need to establish and implement a disaster recovery plan that can deliver on RTO and RPO targets for your most critical data. Some enterprises manage their own disaster recovery needs, while others depend on Backup-as-a-Service (BaaS) or Disaster Recovery-as-a-Service (DRaaS) services from MSPs like TierPoint.

Establish Data Access Policies

Organizations that collect sensitive personal data from their customers may be required by law to ensure that this information can only be accessed by authorized persons for a clear and defined purpose. When this is the case, your data retention policy should establish guidelines for controlling access to any data covered by such regulations.

Assign Roles and Responsibilities

Individual accountability is necessary to ensure that data retention policies will be followed. Your data retention policy should define the key roles and responsibilities for employees involved in data retention management, including IT personnel, department leaders, data owners, legal teams, and compliance officers.

Create a Process for Reviewing Your Data Retention Policy

Finally, it’s always a good idea to create a process for regularly reviewing your data retention policy and updating it as needed. As your business grows, it’s likely that you’ll adopt more applications with services, launch new products, and connect with more customers - and all of that means potentially new types of data that should be covered in your data retention policy.

We recommend regularly reviewing your data retention policy, looking at data inventory to identify new sources of data within the organization, and updating your data retention guidelines and disaster recovery planning to cover the new data.