Question 1

What is a data retention policy?

Accepted Answer

In addition to the above description, organizations must adhere to the international, regional and industry standards that govern areas where an enterprise has customers or does business. Besides the imperative to retain data for a specified length of time, data location has become extremely important and is now a permanent fixture in data retention policies. For example, the European Union’s General Data Protection Regulation (GDPR) rules require that EU citizens’ data be stored within the EU borders. In addition, some industries also come with retention requirements. Companies tend to adopt data retention policies that exceed prevailing regulatory requirements. That is especially true in regulated industries such as healthcare and financial services. For example, companies that do business in the healthcare sector, one of the unique regulatory requirements is the Health Insurance Portability and Accountability Act (HIPAA), which governs healthcare data, and there are requirements around how long HIPAA documentation must be retained, while states govern medical record retention requirements.(1) Also, companies that operate in the United States must adopt Sarbanes-Oxley Act (SOX) compliant data retention policies. An essential aspect of data retention policies is to keep the more expensive primary storage free for frequently accessed data. To that end, enterprises set and enforce policies that move data at the end of their retention period to cheaper secondary or tertiary storage. These storage tiers could be less expensive on-premises disk storage, tape or even cloud storage. The most common storage tiers for secondary and tertiary copies are cloud storage. Cloud storage also offers customers different tiers or levels of storage depending on the data retention requirements. Cloud storage could be considered hot, cold or archive to offer customers different cost structures for their data retention policies.

Question 2

What should be included in a data retention policy?

Accepted Answer

As noted earlier, a data retention policy helps companies manage important data per rules and regulations that govern their business and the locale where they operate. A robust data retention policy would include: Purpose. A data retention policy starts by identifying the purpose of adopting it. Examples may include meeting regulatory requirements or data storage management guidelines for the organization as part of their recovery point objectives. Users and locations. A good practice is to identify the users and the geographic regions that will be covered by the data retention policy. Keeping the data close to source like in the cloud for cloud workloads, or on-premises for local workloads can speed up the recovery when the time comes. Scope. Next, define the scope of the data retention policy and determine the laws, regulations and reference standards or documents that need to be respected. Requirements. Identifying requirements is the heart of any data retention policy. The requirements define the duration of retaining data, safeguarding and then how to handle it at the end of the retention timeline. Rules for data destruction, handling data breaches, and regulatory requirements are also part of an acceptable retention policy. Audits. Companies should adopt routine audits of their data retention policies to ensure that they still are current and within the boundaries of prevailing rules and regulations, and the business recovery point objectives.

Question 3

Why is data retention policy important?

Accepted Answer

Data is the core of any business, whether that is paper invoices, or today’s more common digital information, it all fuels the work of an organization, from inventory to customer records. Companies should identify and capture this critical data to keep the day-to-day business operational and, in the case of regulations, to stay compliant. A robust data retention policy protects enterprises from financial losses, civil and criminal penalties that follow customers’ data loss, and failure to follow prevailing regulations. Examples of heavy financial penalties are a common occurrence on the business news. Gaining and keeping customers’ confidence is vital for business growth. Customers have come to expect that their data, especially personally identifiable information (PII) is protected and remains private. There is little to no tolerance left for negligence when it comes to customers’ data. Business growth requires predictability and confidence that comes from robust data retention policies and regulatory compliance. Businesses can expand into new regions knowing that they will not be surprised by obscure or unknows regulations. Ransomware or cyber-attacks are increasingly more common and protecting the business data from attack is critical. With a policy in place to keep data for a predefined period, it can help prevent ransomware from crippling a business. As these attacks become more advanced and remain dormant from extended periods of time, it is important to include retention guidelines for ransomware in the data retention policy.

Question 4

Does Metallic support your data retention policy?

Accepted Answer

Yes! Metallic Backup as a Service (Baas) solution supports data retention policies. The Metallic portfolio of solutions including, Metallic VM & Kubernetes Backup, Metallic Database Backup, Metallic File & Object Backup, Metallic Backup for Microsoft 365, Metallic Salesforce Backup, and Metallic Endpoint Backup allow users to retain their data and set retention policies according to their requirements. Simple configuration wizards will help you set your retention policy while keeping your data safe and recoverable.

Data retention policy

Data retention policy