Chapter 4 – Information Technology

49170.5 Data Retention Requirements

• Retention procedures shall specify:

  • Steps used to archive information and locations where this information is stored.

  • The appropriate destruction of stored information, electronic or other format, after the identified retention period expires. Such steps shall adhere to the requirements outlined in this policy.

  • Chain of custody and handling of stored information, electronic or other format, when under litigation.

• In certain instances, individual business units have unique record retention requirements outside of documented groups. These requirements shall be documented as part of internal processes and procedures and communicated to the Information Security Officer (ISOInformation Security Officer), RMC and RMAC. Such requirements may include contractual obligations with customers or business contacts or data retention requirements to maintain business operations. In some instances, departments may need to retain electronically stored information for a historical archive.

• During the appropriate retention period for electronic records, archived data shall be retrievable. Doing so requires the following protocols:

  • As new software or hardware is implemented, appropriate department support staff shall ensure new systems and file formats can read legacy data. This may require that older data is converted to newer formats where possible.

  • Data that is encrypted shall be retrievable. The department shall implement key management procedures to ensure encrypted data can be decrypted when needed.

• When establishing record retention periods, the department shall rely on (in order of precedence):

  • Federal and state laws and statutes and regulations.

  • State guidelines, recommendations, rules, and statutory requirements.

  • Internal department requirements and policies.