Data Retention Policies Support Responsible Data Stewardship

Organizations, enterprises, and businesses collect massive amounts of data for their day-to-day operations – these repositories of citizen and consumer data are one of the most valuable assets a company has access to, and they also happen to be a prime target for cybercriminals.

Employing proper protections around collected data and developing sound strategies for appropriate collection, use, retention, and disposal of data is a key component of any organization’s IT security and data governance policy, regardless of their size.

What is a data retention policy, and why is it important?

A retention policy is a rule set up within an IT system that permits or blocks certain actions around a specified piece of data, based on certain parameters that are either met or not met.

For instance, a bank can have a retention policy in place that states all consumer personal data cannot be deleted while the individual still has an account with the bank. The retention policy within the bank’s system would block data deletion if an attempt was made while an account remained active.

Similarly, a manufacturing company that needs to comply with US FDA regulations could implement a Legal Retention Policy, which would lock specific files to prevent them from being deleted, moved, or modified. The company could enable this retention policy so it triggers when a file is tagged with relevant metadata, either manually or automatically through system scan.

How to Create a Retention Policy

To create a retention policy, first an organization must consider the data, balancing the business use case with risk tolerance:

• What kind of data needs to be retained, and for how long?
• How should the data be maintained? (is there a particular format or file type?)
• How accessible does the data need to be, who needs access, and what actions should be available to them?
• Should the data be entirely destroyed after a certain period of time or archived?
• What regulations will come into play based on the collected data, and how will compliance be organized?
• What level of risk will the organization need to accept to retain this data?
• In the event of a violation or breach, what remediation will be necessary?

Once this information has been gathered and assessed, then an organization can begin building a retention policy. In five easy steps, an enterprise can ouline a retention policy:

1. Assemble all pertinent data.
2. Classify the data into different types.
3. Decide what kind of retention policy is required for each type of data.
4. Develop a plan, including identifying who is responsible for which area — communicate accordingly.
5. Create the policy and apply regular updates as needed.

Examples of Retention Requirements for Key Regulations

• HIPAA – 6 years
• FISMA – 3 years
• SEC customer records and account information – 6 years
• SEC trade confirmations, order tickets, and communications – 3 years
• FINRA – 6 years
• SOX – 7 years
• GDPR – no specified time period, but no longer than necessary to fulfil the purposes for which it was collected

Data Retention Policies for Content Lifecycle Management

Sound data management and stewardship strategies serve as the foundation for an efficient and secure organization. Data retention policies are only one part of data management and governance. It’s important for organizations to consider the entire data lifecycle – doing so will help the organization create comprehensive policies that safeguard the organization, not only from cybercriminals hoping to capitalize on collected data, but also pervasive operational inefficiency and regulatory violation penalties.

FileCloud Data Retention Policy Creation

FileCloud is a powerful Enterprise File Sync and Share (EFSS) solution that supports hyper-secure remote access, file storage, and data governance. The Governance dashboard offers a myriad of tools and settings to support data visibility and automated security protocols, including identify authentication integrations, granular file permissions, and access and retention policies.

There are five types of retention policies that can be set in FileCloud. These policy types are hierarchical, which means that certain types outrank others, as a means of ensuring that data is protected at the highest possible requirement. In order of hierarchy preference, these policy types are: Admin Hold, Legal Hold, Retention, Archival, and Trash.

• Admin Hold: Prevents any update or deletion of digital content for an indefinite period of time.
• Legal Hold: Freezes digital content to aid discovery or legal challenges; disallows file modification.
• Retention: Identifies digital content to be retained for an unlimited amount of time before being deleted or released.
• Archival: Moves old organizational content to a long-term storage environment, in which deletion will not be permitted until a certain amount of time has passed.
• Trash Retention: Can be configured for automatic and permanent deletion of all files in the Trash bins or to expire with no actions.