7 best practices for data destruction

Data destruction involves much more than hitting the "delete" key on a computer or moving data to a trash folder and emptying it. Doing either leaves an electronic trail that can still allow an unauthorized computer specialist to retrieve sensitive information. Organizations need to follow best practices in their data destruction and disposition to protect themselves and their customers.

Created in collaboration with its Customer Advisory Board (CAB), Iron Mountain's CAB Guide for destruction and disposition recommends the following seven best practices.

1. Create a metadata standard

Such a standard makes it easier to determine whether to retain or destroy certain records. Destroying records you need and keeping those you don't need can increase expenses for the organization, from both fees for destroying needed records and inefficiencies from maintaining unnecessary records.

2. Establish and maintain a records retention schedule

Organizations need to store some records for a short while, other records for months or years, and still others indefinitely. A records retention schedule defines the operational and legal requirements for the length of records retention, using metadata to determine when a record may be destroyed.

3. Document and develop a destruction process

Establish a destruction process covering physical and electronic records that complies with your records and information management (RIM) policy.

4. Validate and implement

Use a pilot program to test the destruction process to ensure it performs as expected.

5. Manage vendors

Make sure that any third party fulfills your service-level agreement (SLA) requirements, including the certification of any destruction.

6. Monitor and adjust

Your destruction needs will change as your organization evolves. Ensure that the destruction process meets your current needs and is flexible enough to meet your future needs.

7. Develop a documented hold process

Outline steps to follow when destruction is temporarily suspended because of legal or other reasons.