When you're talking about documents transmitted electronically, however, it becomes almost impossible for an organization...
to effectively enforce a document destruction policy. I have read internal reports where organizations estimate that there are at least 16 or more copies of most business documents spread throughout their network. This is mainly due to people including an original message and attachments in their replies.
Documents distributed beyond the corporate network represent a significant concern. Deleted documents can often be recovered easily, while additional versions of a document may unknowingly exist elsewhere. We are a long way from a time when a document's permissions can be embedded at the file level, traveling with the document no matter where it is sent. Ideally, someday your document destruction and retention policy will enforce itself, no matter where the documents are stored.
Another problem, though, with trying to automate document destruction policies is that no uniform standards exist for managing the lifecycle of documents and electronic data. Policies must be tailored to the unique business needs of each organization and its regulatory requirements. And because of the Sarbanes-Oxley Act, intentional document destruction is now a process that must be carefully monitored.
Despite the fact that the enforcement of document retention policies can't be handled by technology alone, the destruction process does bring real benefits: preserving the storage space on the network, on desktops and on backup media. Document retention also optimizes network and search performance and lessens the chance of having information used against an organization in lawsuits.
The period of time for storing business records should be determined by a retention schedule that takes business concerns and the requirements of federal and state regulations into consideration. Detailed logs of all destroyed documents and their exact data should be maintained. When getting rid of documents, be sure that the destruction method renders the information unusable and unrecoverable. Finally, don't just allow anyone to destroy your records. Payroll information, for example, or documents relating to labor relations or legal affairs, should not be entrusted to lower-level employees. If you use third-party contractors, make sure you understand the service level agreement and how they will ensure the security of your documents during the destruction process.
Related Q&A from Michael Cobb
Expert Michael Cobb explains how an HTTP referer header affects user privacy and outlines changes that can be made to ensure sensitive data is not ...continue reading
Expert Michael Cobb explains the difference between the REESSE3+ and IDEA block ciphers and explores when each is applicable in an enterprise setting.continue reading
While cookies are critical to delivering personalized Web content, they are a privacy concern. Learn how adding Bloom filters to cookies can help ...continue reading
Have a question for an expert?
Please add a title for your question
Get answers from a TechTarget expert on whatever's puzzling you.