Both paper documentation and electronic information fuel the work of organizations, and often large streams of digital information cannot easily be stored or cataloged in traditional filing systems. Data retention policy best practices also offer other benefits to any organization.ĭata retention policies in information management are the crux of data management more generally. Retain every monthly backup for 12 monthsįinally, ensure you eliminate any data silos or islands of data outside the backup data retention policy, including desktops, laptops, and remote offices.Īny organization subject to regulations needs a data retention policy, but there are other reasons to develop one.This is an example of a retention schedule set forth in this kind of data backup and retention policy: How long should we keep the data-and does it change depending on the type of data?.Should we backup the data more than once a day? If so, how often?.Is there a risk of data loss? If so, how severe is that risk?.This is, in part, because different business and legal requirements may control various databases, servers, hardware, and other locations.Īny data retention policy guidelines should touch upon backup frequency. In some cases, data located in different places may require unique data retention policies.

Next, consider the location of the data subject. Data stored in databases, documents, email, financial data, images, production data, system state information, and videos might all be important for your personal data retention policy. When considering a personal data retention policy, you must carefully audit all data collected to be sure your data retention policy considers all personal data your organization stores. Next it will usually discuss the detailed data retention requirements, such as a general retention schedule, rules for safeguarding data during retention, guidelines for destruction of data, and rules for breach, enforcement, and compliance. It will then refer to relevant reference documents, laws and regulations. And any business that processes or stores personal information about EU citizens must comply with the General Data Protection Regulation (GDPR), whether or not they are member states.Ī standard data retention policy example will first set forth its purposes in retaining information, define the users it concerns, and clarify its scope. Health care organizations must develop data retention policies that adhere to the Health Insurance and Portability and Accountability Act (HIPAA). For this reason, organizations often use a data retention policy template that is industry-specific.Ī publicly-traded United States companies must establish a Sarbanes-Oxley Act (SOX) data retention policy, for example. Organizations that accept credit card payments must establish Payment Card Industry Data Security Standard (PCI DSS) data retention policies. Organizations frequently develop their own data retention policies however, they must also ensure those policies meet or exceed all applicable data retention laws – especially in tightly regulated verticals. For instance, personnel records and sensitive financial or medical records may all have different retention periods. Instead, organizations must demonstrate that they selectively retain and delete data according to the specific regulatory requirements of their industry and locale. Of course it is important to retain historical data for use, but data retention policies really exist to fulfill regulatory requirements. Organizations subject to these kinds of data retention requirements do not have the financial ability to retain all data forever, nor is that even a desirable goal. This way, primary storage stays cleaner and the organization remains compliant. Once the retention time period for a particular data set expires, it can be deleted or moved as historical data to secondary or tertiary storage, depending on the requirements.

Data retention policies concern what data should be stored or archived, where that should happen, and for exactly how long.

Main purpose of a data backup policy