9.2 Retention, Disposal, and E-Discovery
Key Takeaways
- A retention schedule is a legally binding policy that determines how long records must be kept based on legal, fiscal, and operational requirements.
- A legal hold suspends standard disposal schedules to prevent spoliation of evidence, which is the destruction of relevant records under active or anticipated litigation.
- Data backups and archives serve fundamentally different purposes: backups are for short-term disaster recovery, while archives are for long-term searchable compliance.
- The Electronic Discovery Reference Model (EDRM) outlines nine phases, with Information Governance, Identification, and Preservation acting as critical upfront steps to control cost.
Retention Schedules and Policies
A retention schedule (or records retention schedule) is a legally binding policy document that defines how long an organization must keep specific types of records and the authorization for their final destruction or archive. Developing an effective retention schedule requires a cross-functional effort involving records managers, legal counsel, compliance officers, and business data stewards.
The retention period is determined by analyzing four primary types of value:
- Regulatory/Legal Value: The minimum period mandated by local laws, regulations, and statutes of limitations (e.g., keeping tax documents for 7 years under IRS rules, or employee health records under OSHA guidelines).
- Fiscal Value: The period required to support financial audits, tax filings, and accounting verification.
- Operational Value: How long the business unit actively needs the records to conduct daily operations.
- Historical/Research Value: The long-term value of the records for documenting the organization's history, brand legacy, or long-term research.
Once retention periods are established, they are coded into a formal policy document and integrated into the enterprise's IT systems to automate disposal cycles.
The Legal Hold Process
A legal hold (also known as a preservation order or litigation hold) is a temporary suspension of the normal retention and disposal schedules for any records (physical or digital) that are potentially relevant to active or reasonably anticipated litigation, audit, or government investigation.
- The Trigger: The legal hold obligation is triggered as soon as litigation or an investigation is "reasonably anticipated." Organizations do not have to wait for an official subpoena or lawsuit to be filed; the mere knowledge of an impending dispute triggers the preservation duty.
- Spoliation of Evidence: The failure to preserve relevant records after the duty is triggered is known as spoliation. Courts treat spoliation as a severe offense. Sanctions can include multi-million dollar fines, default judgments, or "adverse inference instructions," where the jury is instructed to assume that the destroyed records contained evidence unfavorable to the organization.
- Release: A legal hold can only be formally released by legal counsel in writing. Once released, the records return to their standard retention schedules and can be disposed of if their retention period has expired.
Archiving vs. Data Backups
A common exam trap on the CDMP is confusing backups with archives. While both involve copying or moving data, their operational goals, searchability, and lifecycle properties are fundamentally different:
| Aspect | Data Backup | Data Archive |
|---|---|---|
| Primary Purpose | Disaster recovery and operational continuity (system restoration after a crash). | Long-term regulatory compliance, legal discovery, and historical preservation. |
| Data Status | Short-term copy of active, changing databases and systems. | Long-term storage of inactive, finalized, and immutable records. |
| Retention Cycle | Short-term (typically overwritten or deleted in rolling 30, 60, or 90-day cycles). | Long-term to permanent (held for years, decades, or indefinitely according to policy). |
| Retrieval Capability | Bulk restoration (poor searchability for individual files or emails). | Granular search and retrieval of individual files based on metadata and tags. |
| Immutability | Can be overwritten, modified, or deleted during system restoration. | Strictly immutable (protected against any modification or unauthorized deletion). |
The Electronic Discovery Reference Model (EDRM)
During litigation, organizations must produce relevant Electronically Stored Information (ESI) through a process known as e-discovery. The Electronic Discovery Reference Model (EDRM) outlines the standardized phases of this lifecycle. Strong data management practices in the early phases dramatically reduce the volume and cost of data processed in the later phases:
-
Information Governance: The proactive foundation of policies, procedures, and technology to manage data before litigation is ever anticipated.
-
Identification: Locating potential sources of relevant ESI (laptops, servers, cloud applications, messaging platforms) when litigation is anticipated.
-
Preservation: Securing ESI against alteration or destruction (applying legal holds and isolating data storage).
-
Collection: Gathering ESI from its original sources in a forensically sound manner to preserve metadata (such as file path, author, and system dates).
-
Processing: Deduplicating and converting files to a manageable format, reducing the total volume of data before review.
-
Review: Evaluating collected records for legal responsiveness, confidentiality, and attorney-client privilege.
-
Analysis: Evaluating the content of documents for key patterns, timelines, and case strategies.
-
Production: Formatting and delivering the responsive documents to opposing counsel or the courts in legally agreed formats.
-
Presentation: Displaying and explaining ESI during depositions, hearings, or trials to make a legal case.
Secure Disposal and Destruction
When records reach the end of their authorized retention period, they must undergo secure disposal. Simply deleting files from a server or throwing paper in a recycling bin is insufficient. Secure disposal ensures that records are rendered completely unrecoverable, protecting client privacy and intellectual property.
- Physical Destruction: Methods include shredding, pulping, or incinerating paper documents and physically crushing or shredding storage media (such as hard drives and backup tapes).
- Digital Destruction: Methods include degaussing (using high-powered magnetic fields to erase magnetic media), overwriting (writing binary patterns over disk sectors), and cryptographic erasure (destroying the decryption keys for encrypted data, rendering it permanently unreadable).
- Certificate of Destruction: A legal document issued by an authorized disposal vendor verifying the date, method, and specific items destroyed. This serves as audit proof that records were destroyed under compliance policies.
Which of the following actions is triggered immediately when an organization reasonably anticipates a lawsuit or regulatory investigation, suspending normal record disposal?
In the Electronic Discovery Reference Model (EDRM), which phase occurs after the identification of potentially relevant data and focuses on securing it from deletion or alteration?