Skip to content

Publication Summary

Title Record Retention and Protection Policy
Author(s) Alessandro Cardinali
Issued by CEO

Version doc.

Review freq.

0.1

Yearly
Date of issue December 11, 2023
Owner Alessandro Cardinali
Document status Draft – Final Draft - Final
Approval Date n/a
Classification Internal

Change Log

Version Date Author Comments
0.1 December 11, 2023 First draft document
1.0 December 20, 2023

Contents

1 Introduction 8

2 Records retention and protection policy 9

2.1 General principles 9

2.2 Record types and guidelines 9

2.3 Use of cryptography 10

2.4 Media selection 11

2.5 Record retrieval 11

2.6 Record destruction 11

2.7 Record review 11

Tables

Table 1: Record types and retention periods 10

Introduction

In its everyday business operations [Organization Name] collects and stores records of many types and in a variety of different formats. The relative importance and sensitivity of these records also varies and is subject to the organization’s security classification scheme (see Information Classification Procedure).

It is important that these records are protected from loss, destruction, falsification, unauthorised access and unauthorised release and range of controls are used to ensure this, including backups, access control and encryption.

[Organization Name] also has a responsibility to ensure that it complies with all relevant legal, regulatory and contractual requirements in the collection, storage, retrieval and destruction of records, including those concerned with the protection of personal data.

This control applies to all systems, people and processes that constitute the organization’s information systems, including board members, directors, employees, suppliers and other third parties who have access to [Organization Name] systems.

The following policies and procedures are relevant to this document:

2 Records retention and protection policy

This policy begins by establishing the main principles that must be adopted when considering record retention and protection. It then sets out the types of records held by [Organization Name] and their general requirements before discussing record protection, destruction and management.

General principles

There are several key general principles that must be adopted when considering record retention and protection policy. These are:

  • Records must be held in compliance with all applicable legal, regulatory and contractual requirements, including those related to privacy (for example the EU GDPR)

  • Records must not be held for any longer than required

  • The protection of records in terms of their confidentiality, integrity and availability must be in accordance with their security classification

  • Records must always remain retrievable in line with business requirements

A summary of the specific requirements of the relevant data protection laws can be found in Legal, Regulatory and Contractual Requirements.

Record types and guidelines

In order to assist with the definition of guidelines for record retention and protection, records held by [Organization Name] are grouped into the categories listed in the table on the following page. For each of these categories, the required or recommended retention period and allowable storage media are also given, together with a reason for the recommendation or requirement.

Note that these are guidelines only and there may be specific circumstances where records need to be kept for a longer or shorter period of time. This should be decided on a case-by-case basis as part of the design of the information security elements of new or significantly changed processes and services.

Further information about records held by the organization, including their security classifications and owners can be found in Information Asset Inventory.

RECORD CATEGORY DESCRIPTION RETENTION PERIOD REASON FOR RETENTION PERIOD ALLOWABLE STORAGE MEDIA
Accounting Invoices, purchase orders, accounts and other historical financial records X years SOX compliance requirement Electronic only – paper records must be scanned
Budgeting and Forecasting Forward-looking financial estimates and plans X years SOX compliance requirement Electronic, paper
System Transaction Logs Database journals and other logs used for database recovery X years Based on backup and recovery strategy Electronic, tape media
Audit Logs Security logs e.g. records of logon/logoff and permission changes X years Maximum period of delay before forensic investigation Electronic
Operational Procedures Records associated with the completion of operational procedures X years Maximum period of time elapsed regarding dispute Electronic, paper
Customer Customer names, addresses, order history, credit card and bank details X years after last purchase Data protection requirement Electronic, paper
Supplier Supplier names, addresses, company details X years after end of supply Maximum period within which dispute might occur Electronic, paper, microfiche
Human resources Employee names, addresses, bank details, tax codes, employment history X years after end of employment Data protection requirement; Employment law Electronic, paper
Contractual Legal contracts, terms and conditions, leases X years after contract end Maximum period within which dispute might occur Electronic, paper
Further categories


Table 1: Record types and retention periods

Use of cryptography

Where appropriate to the classification of information and the storage medium, cryptographic techniques may be used to ensure the confidentiality and integrity of records.

Care must be taken to ensure that encryption keys used to encrypt records are securely stored for the life of the relevant records and comply with the organization’s policy on cryptography (see Cryptographic Policy).

Media selection

The choice of long-term storage media must consider the physical characteristics of the medium and the length of time it will be in use.

Where records are legally (or practically) required to be stored on paper, adequate precautions must be taken to ensure that environmental conditions remain suitable for the type of paper used. Where possible, backup copies of such records may be taken by methods such as scanning or microfiche. Regular checks must be made to assess the rate of deterioration of the paper and action taken to preserve the records if required.

For records stored on electronic media such as tape, similar precautions must be taken to ensure the longevity of the materials, including correct storage and copying onto more robust media if necessary. The ability to read the contents of the particular tape (or other similar media) format must be maintained by the keeping of a device capable of processing it. If this is impractical an external third party may be employed to convert the media onto an alternative format.

Record retrieval

There is little point in retaining records if they are not able to be accessed in line with business or legal requirements. The choice and maintenance of record storage facilities must ensure that records can be retrieved in a usable format within an acceptable period of time. An appropriate balance should be struck between the cost of storage and the speed of retrieval so that the most likely circumstances are adequately catered for.

Record destruction

Once records have reached the end of their life according to the defined policy, they must be securely destroyed in a manner that ensures that they can no longer be used in line with Procedure for the Management of Removable Media.

This procedure allows for the correct recording of the details of disposal which must be retained as evidence.

Record review

The retention and storage of records must be subject to a regular review process carried out under the guidance of management to ensure that:

  • The policy on records retention and protection remains valid

  • Records are being retained according to the policy

  • Records are being securely disposed of when no longer required

  • Legal, regulatory and contractual requirements are being fulfilled

  • Processes for record retrieval are meeting business requirements

The results of these reviews must be recorded.