Defensible deletion

When it comes to defensible deletion, is it enough to say that your organization is disposing of its obsolete Records according to the Retention schedules? To prove that a record has been deleted, the link to the record will be empty or it won’t produce any record. Do I need to produce a deletion log listing all the Records that were deleted, or would saying that Records were deleted according to the Retention schedule and that the link to the deleted Record is empty be sufficient to have a defensible deletion in place?

3 Likes

In my experience, it was enough to produce the retention schedule, but not sure if any further rules have been issued.

In your Records Management solution design, you should have an audit table logging all actions taken in your document platform, which would include all of the logs of a record being destroyed.

That way, as the rules predictably tighten, you’ll already be ready to comply with the new ones.

We know that most laws are moving towards requiring a complete audit log, so I’d suggest laying the groundwork for audits if you haven’t done so already.

1 Like

If your solution doesn’t come with an automated audit logging mechanism, you should create an index (spreadsheet) of items destroyed as part of any certification of destruction (if its high risk records, should be at the item level but if part of regular ongoing destruction could be a file level, date range level, etc.). Depending on the risk, you may also want to consider having a witness to the event. In my experience, a retention schedule gives you the authority, but not the evidence, of disposition.

2 Likes

After applying the RRS, we produce a form letter for review and disposition action (including destruction), to be authorized by the Author/Owner of the records, and archive the letter indefinitely. Just like your database to manage storage, ours deletes the existence of the box to free the location for new storage. We use a simple ITS system to track/trend/report the destructions performed by our onsite hammer mill. A bit redundant, but highly defendable for our physical records program.

Thanks a lot for your replies to my question

After over 30 years in this work, I have only been asked once about deletion. We showed to opposing consul the job logs of backup tapes going back into rotation after 32 days (or less). They just couldn’t believe backups were that short. Otherwise the retention schedule has always satisfied a question. Too many consultants overplay this as a big issue. There is no legal expectation that everything is deleted perfectly each year. Stuff will be missed, errors made etc. As long as you can show you have review/disposal processes in place and a good retention schedule, the chance of an issue is extremely remote.

1 Like

For a small organization it might be the case but depending of the type of records especially in large organization you might have to keep a bit more information. Most places have to keep a log of all records they delete or dispose of. We use the term disposition to differentiate between destruction/deletion and the move of a record from a branch to HQ or other storage or review areas (e.g. historical review of certain files, images, films, objects etc). Our retention periods represent the minimum period (legal or not) during which a location has to hold on to a record but and does not mean it’s automatic destruction when the retention period expires. A report periodically generated is given to the expert matter (e.g. for files related to a policy area) or program manager (e,g. Benefit Unit) and they have to authorises or not the ‘‘disposition’’ of the records reaching their retention period (signing the report). Records kept beyond their initial retention period represent an additional liability (cost of storage, review etc) and must be justified. Some places refer to this extension as ‘‘renewing the lease’’ of a record. In many cases, the end of the retention period can also be the beginning of another cycle for certain ‘‘documents’’ such as moving it to a secondary location for safekeeping, archiving or a longer period of retention and disposal years later as prescribe by Federal or State laws (e.g. a letter of offer in a federal agency moved from a small HR office to the federal Government pension records where it is kept for 90 years). A process overall requiring extensive documentation and training and logs. Cheers

1 Like

Forgot to state that in the 30+ years I have worked in two global companies, current one has people in 70 countries. There are extremely few laws that make you prove disposal such as insurance law in Illinois (Indiana?) for state regulators, and retaining what the Chinese govt requires when they approve accounting records for disposal. Never build a mountain when a mole hill or no hill will be more than enough.

2 Likes