7 data destruction best practices

Are you following data destruction best practices? Have you destroyed the data you no longer need? Are you sure it can't be recovered by a dumpster diver or someone with advanced computer skills?

Reasons to Destroy Records

Iron Mountain's Practical Guide to Records and Information Management Destruction notes that organizations must properly destroy unneeded records to:

• Protect their sensitive data
• Comply with the General Data Protection Regulation (GDPR), the California Consumer Privacy Act and other privacy laws
• Comply with their own records and information management (RIM) policies

By destroying unneeded records, organizations also boost efficiency by lowering storage costs and spending less time and money searching for records required for various business purposes.

However, organizations face the following data destruction challenges:

• An ill-defined destruction process
• Legal requirements and restrictions concerning data destruction
• The decision of what to retain
• Missing or inadequate controls

The following tips will help your organization overcome these challenges and take charge of its data.

7 Best Practices

The Practical Guide describes seven data destruction best practices:

1. Create a metadata standard. Metadata simplifies searches for paper and electronic documents and should contain records retention data as well. Iron Mountain's Customer Advisory Board (CAB), which helped develop the Practical Guide, has also published the Metadata Standard Guide to provide the best practices for metadata implementation and uses.
2. Establish and maintain a records retention schedule. This policy document identifies the length of time records must be retained for legal and operational purposes.
3. Develop and document a destruction process outlining the steps needed to destroy records in accordance with the company's RIM policy. Departments across the organization should collaborate in developing this process.
4. Validate and implement the destruction process. Use pilot programs to test the process to ensure it works as expected.
5. Manage vendors. Third-party organizations that specialize in records retention, storage and destruction can help you properly destroy records. However, you should ensure that any third parties meet the requirements spelled out in service-level agreements.
6. Monitor and adjust your process as needed. As your organization and documents retention and destruction regulations evolve, so should your policies on these matters.
7. Establish a document hold process. You need to know what to do when the destruction of records is delayed for regulatory or business reasons.

Further Advice

Beyond more details on the best practices outlined above, the Practical Guide provides comprehensive information on roles and responsibilities for RIM, IT, legal/risk, compliance, data management/data governance, information privacy, information security, audit and business operations managers.

A thorough examination of the Practical Guide will help your organization follow data destruction best practices.