It is a challenge to declutter and throw things away. After all, we think that what now looks like clutter may be useful someday.
Just as a person might develop a hoarding disorder that interferes with his or her life, a company, also, can fall victim to keeping too many records too long so that they interfere with the company’s business.
Records can take over company offices and off-site storage locations when in paper form and can clutter up the company’s servers and cloud storage sites when in electronic form. The company may find itself seeking to secure ever increasing record and data storage space to feed an insatiable need that all records be saved – or perhaps just a fear of discarding the wrong thing.
As important as it is that some records be kept, it is equally important that the business discard records on a timely basis. Yet, when it comes time to clean up, both for individuals and business, the task can seem overwhelming – particularly without guidance about which items should be saved and which should be discarded. It also is important that the company establish protocols about where and how documents should be saved.
The consequences of inadequate document retention practices can be significant. The news regularly reports data breaches caused when an employee saved private, unencrypted data on a laptop, only to have the laptop stolen, resulting in a costly and embarrassing privacy breach.
In one company without a Document Retention Plan (“DRP”), instead of saving records to the company’s cloud drive, some employees were saving their records to their individual office PC hard drives. This lapse was discovered only after the PCs were replaced as a new computer system was implemented. Unfortunately, this occurred during a government investigation. The resulting penalties to the company far exceeded the cost it would have spent on the development and implementation of a DRP.
DRPs not “one size fits all”. A business’ DRP should be customized not only to assure that the company complies with legal requirements but also to meet the practical needs of the industry and the business, itself. For instance, some documents may be retained longer than legally required in order to adhere to industry standards, meet customer needs, or in anticipation of litigation.
A DRP also must address the fact that not all “documents” are in traditional written form. Some company records may be stored electronically on company computers, in company cloud space, on company mobile devices, on flash drives, or even with company contractors. Also, records can include audio and video, as well as the written word.
Adopting a DRP is only the first step, however. Implementation and consistent application of the DRP at every level in the company is critical. After adoption of a DRP, the company should select an individual document retention manager inside the company who is responsible for implementation and compliance with the DRP.
Using the company’s DRP as a guide, the document retention manager should develop storage systems both on-site and off-site as needed with a goal of minimizing both storage and retrieval costs. Every employee, regardless of function, should receive training about the DRP and be enlisted to assist with DRP compliance on a daily basis.
Finally, the document retention manager should supervise regular compliance audits and retaining, to assure that the company operations conform to the DRP and that the DRP continues to meet the company’s needs.
A DRP won’t clean out your office or your storage unit for you, but it is a good business practice and can eliminate much of the stress and risk from the decision about when, where, how, and how long to save documents.
Elizabeth Whitman © 2016
Disclaimer: The content of this blog is intended for informational purposes only. It is not intended to solicit business or to provide legal advice. Laws differ by state and jurisdiction. The information on this blog may not apply to every reader. You should not take any legal action based upon the information contained on this blog without first seeking professional counsel. Your use of the blog does not create an attorney-client relationship between you and Mirsky Law Group, LLC.