Records Retention and Cloud–Based Storage

I’m often asked a question that goes something like this: “We’ve moved our records to a cloud-based vendor. How do we implement our records retention schedule on the vendor’s system?”  More often than not, this question involves personnel records and other human resources records, because there’s a big industry of outsourced HR functions, but it could be other records as well.

Many times, the answer that I have to give isn’t the one they want to hear. This is particularly true when the move has already been made.

Your Data, Their Notions of Retention

In most cases, when your records and data are put into someone else’s system, you’re stuck with the configuration and capabilities (and as a result, the limitations) of that system. What many organizations discover too late to do anything about it, is that the vendor and whoever designed their system really never thought about records retention schedules and the concepts behind them.  When the issue is raised, the vendor gets that deer-in-the-headlights look. Up till now, their attitude may have been exactly the opposite: they regarded it as a selling point that “All of your data will be retained indefinitely”.

If you find yourself in this situation, your options are likely to be limited. If your organization is big enough (and by implication, spending enough money with the vendor), you may be able to leverage that size to get the vendor to consider potential solutions. Failing that, if you’re having this problem, it’s likely that other organizations using that vendor are also having the same problem. You can network with them, you may be able to collectively prod the vendor into doing something.

What to Do?

The question then is, what can the vendor actually do? If they’ve got a gigantic as SAS system that isn’t configured to implement records disposition on a client–by–client and record-type-by-record-type basis, they aren’t going to be able to reconfigure it in a week or month, if in fact they can reconfigure it at all. Their options, and as a result your options, may be severely limited by inherent limitations in technology. And if the fix does come, its likely to be a long and painful process to get there.

Don’t Shoot First and Ask Questions Later

The bottom line of all of this is that the time to think about your records retention schedule is before you select a vendor and move everything to their system. Questions about purging and disposition, as well as retrieving your data if you switch vendors (another vexing problem that’s often ignored) should be part of the RFP/RFQ process, so that you know before you are committed what your options will be. Do that, you’ll avoid a lot of headaches down the road.

1 reply
  1. Darrell Jones
    Darrell Jones says:

    One element that is sometimes overlooked, is the meta data about the data being stored in the services. The licensing agreements either omit this data from the agreement or state that this information is the IP of the hosting organization. My experience has been, that the hosting companies retain this information forever.

    Reply

Leave a Reply

Want to join the discussion?
Feel free to contribute!

Leave a Reply

Your email address will not be published. Required fields are marked *