Navigating record disposition can be a daunting task. After all, you need to consider the legal and financial ramifications of your decision to retain or discard specific records.
It’s essential that you have a thorough understanding of what records are legally required to be kept (and for how long), as well as when—or even if—records can be destroyed.
We’ll discuss four key factors that can help guide your decision-making when it comes to records disposition. This guide will help you determine whether to destroy or archive a record and develop an effective plan that meets compliance standards and maintains control over all of your records.
#1 – Establish a Record Retention Schedule
Build a comprehensive retention schedule as your first step. There’s no way to know what should happen at a record’s end-of-life if you don’t know how long that period should be. The schedule will help you to set out clear guidelines around how long various records will be retained, as well as provide guidance on how to store, maintain and manage these records over time.
It’s important to ensure legal obligations associated with record retention are met, so researching applicable regulations is key. This includes any industry-specific regulations or standards related to the records being stored, such as GDPR in Europe or HIPAA in the US.
Not sure where to start when it comes to establishing a records retention schedule? Here’s more information that can help: Record Retention Schedules – What’s in Them, How to Develop One, and More!
#2 – Determine Record Disposition Plans
Include disposal or archival plans within your record retention schedule. When information becomes obsolete or is no longer needed it should be safely disposed of following established protocols or archived securely if required by law. This can get complicated as even a domestic-only, US-based company can be subject to as many as 15,000 to 20,000 retention regulations.
If a document or record has historical value, your disposition plans should include a transfer of ownership over to your archives. Should a record be sent to the archives, the retention period is indefinite, and it should be kept there permanently.
Building a RIM Program From Scratch: Dispose: Archive vs. Destroy, Holds Revisited – Presented by ARMA
Have you been tasked with establishing a records and information management (RIM) program and don’t know where to begin? This 5-part webinar series on Building a RIM Program from Scratch is tailored for those new to the RIM profession, this…
#3 – Document Your Plans Thoroughly
Creating a defensible disposition policy requires you to ensure the disposition plans within your retention schedule are thorough. Even established retention schedules can be tricky to manage. You must account for situations that may have you holding onto a record for longer than what your policy states, and this may be legally necessary. You will just have to make accommodations for documenting a reason for retaining the record in your policy.
For example, records pertaining to a terminated employee must be retained for 40 years, even though those records may contain PII that is supposed to be destroyed much earlier. You will remain in compliance with a retention schedule that accounts for that discrepancy.
“If you’re over-retaining, it should be for business purposes,” notes Omero Banuelos, Esq. Senior Counsel at Access during a past webinar. “It should be recorded and part of your retention schedule; assigned a retention period.”
Be careful though— if the information is retained longer than your policy states and there is no proper documentation of the reason for extending the retention period, there can be compounding fines and risks.
#4 – Review Your Retention Schedule Regularly
Review record retention schedules on a regular basis and update them accordingly to reflect changing needs and regulations and to ensure compliance with all applicable laws. It might seem easier to have a blanket policy that says to “keep everything forever” but with constantly changing privacy laws, that’s no longer an option. Retaining documents longer than legally necessary exposes your organization to unnecessary risk, especially during a discovery process for litigation or a data breach.
To keep up with the constantly changing laws and regulations related to records disposition, your organization may want to consider a tool that does legal research for you.
For more on this topic, check out Building a RIM Program From Scratch – Dispose: Archive vs. Destroy, Holds Revisited. There, you’ll watch as experts discuss the Generally Accepted Recordkeeping Principles (GARP) as they relate to disposition.