| 1. Consider the business requirementEach business | | | | beginning with regulatory and other legally established |
| needs to identify what types of data need to be | | | | minimum periods. Identify all categories covered; |
| kept for specific periods of time. In the case of | | | | categorise the data subject to regulations and |
| email, for example, these distinctions could include | | | | identify the required minimum retention period for |
| different retention periods for different departments, | | | | each category. Consider to use the same minimum |
| or for different projects, or for different levels of | | | | retention period for all regulated information for |
| management. Retention is also a question of storage | | | | consistency or whether to define separate retention |
| space. Organisations need to ensure that individual | | | | periods. |
| mailboxes are used only for communication and | | | | |
| short-term storage, not as the primary means for | | | | 7. AccessibilityThe information must be accessible, |
| official record retention. | | | | searchable, and retrievable when needed. With |
| | | | | InTechnology's Online Data Archiving service data can |
| 2. Recognise your legal and regulatory | | | | be retrieved without the time and expense of |
| obligationsEstablish clear, recorded and defensible | | | | backup tape restoration. System-wide archiving |
| retention policies that demonstrate your ability to | | | | permits classification of data, automated search and |
| meet business needs as well as legal and regulatory | | | | retrieval, and data deduplication. |
| obligations for data and email. These policies need to | | | | |
| include schedules that demonstrate appropriate | | | | 8. Use the right toolsDeploying an indefinite data |
| retention periods for the various categories of | | | | archiving policy while permanent retention schedules |
| information. Businesses that do not preserve data | | | | are being developed, provides your company with |
| long enough to meet their legal other regulatory | | | | the immediate ability to preserve information for later |
| obligations may face severe penalties as a result. | | | | review and decision by your legal department. This |
| | | | | reduces the chance of inadvertent destruction. |
| 3. Only keep hold of the data you need toOn the | | | | Interim data archiving gives IT an opportunity to |
| other hand, retaining information for too long creates | | | | understand the technology, fine-tune the deployment, |
| a different risk; that of being compelled to produce | | | | before defining the permanent policy. IT can begin to |
| information that could defensibly have been | | | | estimate the amount of storage capacity required to |
| destroyed. A well-planned retention policy, addressing | | | | retain email, which can be useful for planning. The |
| both minimum and maximum retention times, limits | | | | data archived during the interim can then be |
| the information pool to what is both timely and | | | | reviewed, and disposed of as appropriate. |
| potentially relevant. | | | | |
| | | | | 9. Address your business needsWhen determining the |
| 4. Collect the personnelTo make the best informed | | | | business requirements, the following should be |
| decisions when setting the data archiving policy, you | | | | considered: |
| should collect the personnel who have knowledge and | | | | - How often access to the data is likely to be |
| authority of the organisation's business needs both | | | | needed |
| departmental, and as a whole. Developing a full | | | | - Whether data is either superseded by/or included |
| picture of the organisation's data use and | | | | in later versions |
| requirements enables you to set the most efficient | | | | - The extent to which data is distributed outside the |
| policy, ensuring that the retention periods reflect the | | | | business |
| business' needs. | | | | - The potential for related legal action or other |
| | | | | adversarial action |
| 5. Collect the informationIf you have an existing | | | | - The purpose of the data, both in its creation and in |
| policy regarding records and information management | | | | its distribution |
| or a policy that identifies the data being archived, | | | | - The intended use and distribution of the data |
| then that is the place to start. All the data that is | | | | |
| going to be archived needs to have a retention | | | | 10. Document and circulate: create a written data |
| period assigned to it and must be included in a | | | | retention policyThe newly established data retention |
| retention schedule. If you plan to begin archiving data | | | | periods need to be recorded, both for distribution to |
| immediately, the initial retention period may be | | | | users and as part of the legal defensibility record. The |
| "indefinite" while the policy and schedule are decided. | | | | schedule does not need to be elaborate, but it should |
| | | | | include specifics about the various categories and |
| 6. Set the retention periodsYou now need to | | | | associated retention periods. |
| determine the actual specific retention periods, | | | | |