What Is a Data Retention Policy and How Do You Implement One?

In 2021, the U.S. Commodity Futures Trading Commission ordered financial powerhouse JPMorgan to pay $75 million for widespread recordkeeping failures, and the Securities and Exchange Commission issued a fine for another $125 million. These events emphasize how vital data retention policies are for modern businesses — even industry leaders. How can your organization design and follow good information governance practices?

What Are Data Retention Policies?

In simple terms, a data retention policy is your organization’s set of procedures for;

• gathering
• storing
• managing
• disposing

data. These guidelines should cover;

• what type of information you capture
• which data formats you use
• how long you keep records
• where you archive them

A good data retention policy has several objectives:

• Complying with legal, financial and regulatory requirements for data storage
• Meeting customer needs for records and third-party audits
• Taking steps to protect individual privacy
• Safeguarding proprietary data
• Maintaining access to necessary files
• Managing data so records are easy to track and locate

Data retention is related to information governance and cybersecurity.

What Types of Information Should Data Retention Policies Include?

The amount of data enterprise businesses capture and produce can be staggering:

• Customer data: Customer lists, contracts, invoices, purchase orders, tax ID numbers, credit card numbers/tokens
• Financial data: Balance sheets, tax records, expenses
• Human resources data: Payroll, employee records, workers' compensation claims, performance evaluations
• Company communications: Emails, text messages, attachments, enterprise platform chats
• Operational information: Quality control reports, audits, test results, proposals, board meeting records, certifications
• Proprietary data: Management information, new project data, executive communications, intellectual property, business assets, other key records

An effective records retention policy must cover all of these records and many others. Enterprise archives can easily involve hundreds of terabytes of data or more.

What Is a Good Data Retention Policy for Enterprises?

Your organization’s information governance standards must be fluid, adapting to company needs and scaling with them. You should have a separate retention policy for each type of data your organization handles.

You should also consider your data backups - how long should you store backups? Some organizations maintain:

• Daily backups for a week
• Weekly backups for four to six weeks
• Monthly backups for one year
• Annual backups for five to seven years

A solid data retention plan with secure backups can save your business if a ransomware attack blocks your access to key records.

Which Industries Need To Create a Policy for Data Retention?

Given increasing government regulations, industry trends and consumer expectations, information governance best practices require every enterprise to create data retention policies. Some industries have a stronger need to follow information governance procedures than others:

• Healthcare organizations must follow HIPAA guidelines for protected health information.
• Enterprises handling credit card data must be PCI-DSS compliant.
• Publicly traded corporations have to follow SOX records retention rules and SEC instructions.
• Financial institutions, insurers, brokerage houses, SaaS companies, defense contractors and other businesses seek ISO 27001 information security certification.

If your organization has room to improve, you’re not alone. According to industry research, fewer than 20%of large-scale businesses have implemented data retention or information governance procedures. Still, taking action is urgent in the modern world.

What Is an Example of a Data Retention Policy?

An enterprise data retention policy template should include the following sections.

Policy or Document Name

Specify which type of business records, customer data or communications the data retention policy covers. For example, one policy may deal with customer data (account numbers, billing information, etc.) while another with employee onboarding documents.

Purpose

Briefly outline the purpose of the data retention policy, e.g. “The purpose of this document is to explain how and where to store customer account information, and for how long.”

Scope

Mention the specific type of data the policy refers to. For customer accounts, documents could include:

• Invoices and purchase orders
• Order history and delivery confirmations
• Business tax ID numbers, credit card information or bank details
• Shipping addresses, email addresses and contact information

Don’t forget to include client communications such as emails and texts.

Information Governance Responsibilities

Always list the manager, executive or team responsible for creating, modifying and updating data retention policies. That way, you establish who to contact for gray-area questions, and unauthorized individuals can’t unilaterally change policies.

Details

Mention additional relevant details. For example, if you have one data policy for consumers and another for business customers, specify which group the document applies to.

Retention Period

State how long your organization retains the covered data. Here are a few industry standards:

• ISO 27001: Three years
• HIPAA: Six years
• PCI-DSS: Discretion of enterprise
• Sarbanes-Oxley Act: Seven years

Please note that we are not law experts, so, ensure you check the requirements for your business, in your geography.

In this section, you can also mention your organization's process for customers to request account closure or deletion of data.

Data Disposal Procedures

Outline what you do with data after the retention period ends. Some documents may be deleted from servers and others may need to be archived for legal or financial reasons.

Data Security Measures

Explain how and where protected data is kept. Be as specific as possible, including details about:

• Data format (e.g. electronic file or PDF)
• Encryption in transit or at rest
• Password protection or multi-factor authentication measures
• Personnel with permission to access the data
• Approved storage location (e.g., cloud storage, on-premises server, or virtual private network)
• File system (such as folders only available to the accounts payable department)

This document serves as a guideline for your business and also allows regulators and customers to see how you manage data.

Why Are Data Retention Policies Important for Modern Businesses?

A common misconception is that data retention is a frustrating and unrewarding obligation. In reality, implementing information governance provides significant benefits for enterprises.

GDPR Compliance

The European Union represents a lucrative market for global companies — one worth over €14 trillion a year. To do business with the EU’s 440 million consumers or trade with powerhouses such as Germany, France and Italy, your enterprise must comply with the General Data Protection Regulation.

Creating and following clear data retention policies is a huge part of GDPR compliance. This includes telling customers exactly how you use their data, how long you keep it and what you do with it afterward.

Good Cybersecurity Practices

Many security breaches happened because organizations were careless with data. All it takes are sensitive documents left unprotected or expired security credentials left activated to give hackers access. This is an especially challenging problem for enterprises with dozens of locations and thousands of employees.

On the other hand, when your organization provides clear guidelines for storage, handling and disposal of sensitive records, the risks of an intrusion are much lower. In turn, customers have more confidence in your security and you avoid the expensive consequences of ransomware attacks.

More Efficient Operations

One of the most common causes of wasted time on the job involves employees trying to find documents. It costs even more time and money to remake lost or accidentally deleted records.

When you store your enterprise’s records in one secure, central location — such as the cloud — the right departments can locate necessary data quickly. The result is increased productivity, accuracy, efficiency and profitability.

How To Implement Data Retention Policies Effectively In Your Organization

Don’t make data retention the responsibility of end users or knowledge workers. That’s a recipe for disaster. Instead, manage information governance from the top down, preferably with automated processes.

At Cloudficient, we offer state-of-the-art, streamlined solutions for enterprise data migration. Cloud-based storage tools simplify data retention policies for emails, security backups, archived files and other company data. Contact us to learn more about the benefits.

With unmatched next generation migration technology, Cloudficient is revolutionizing the way businesses retire legacy systems and transform their organization into the cloud. Our business constantly remains focused on client needs and creating product offerings that match them. We provide affordable services that are scalable, fast and seamless.

If you would like to learn more about how to bring Cloudficiency to your migration project, visit our website, or contact us.