A firm accumulates data in laptops, phones, scanners, backups, cloud accounts and paper. When a device is replaced or a record reaches the end of its retention, the data has to go, and it has to go for good.
The retention period is set by your attorney, according to the rules that apply to the firm and the matter. We do not set it. This article is about the removal.
The problem
Deleting a file, emptying the recycle bin or reformatting a drive often leaves the data recoverable. A laptop sold, donated or returned at the end of a lease may carry years of client files.
Copiers and scanners that store documents on an internal drive are easy to forget.
What is known
NIST, the US standards agency, publishes guidelines on media sanitization. We describe them in plain terms and do not give any figure.
They describe three levels. Clear overwrites data with ordinary commands and protects against simple recovery. Purge uses stronger methods, such as a secure erase built into the drive or erasing the key of a drive that protects its data. Recovery is then not feasible, even with laboratory techniques. Destroy physically ruins the media so it cannot be used again.
The right level depends on how sensitive the data is and what happens to the device afterwards: reused in the firm, sold, donated, returned or scrapped.
What to do
- Keep an inventory of where firm data lives: computers, phones, tablets, copiers, scanners, external drives, backups, cloud accounts and paper
- Ask your attorney for the retention rules and for any duty to preserve records, such as for a pending dispute, and do not delete anything that must be kept
- Match the method to the device and its next step: a device that stays in the firm needs less than one that leaves its control
- Use a vendor or a tool that follows the NIST levels, and ask it to say which level it applied
- Record each disposal: what, when, how, who did it and, for a vendor, a written confirmation
- Shred paper, and remember that old files in boxes and storage units count
- Remove a device's access to accounts before it leaves: sign it out, remove it from the firm's management and cancel its tokens
Where firms get caught out
- Treating a factory reset or a reformat as enough for a device that is leaving the firm
- Forgetting that a copier or scanner has a drive, especially at the end of a lease
- Deleting from the live system while old copies remain in backups and exports
- Deleting something that was under a duty to preserve
- Having no record, so the firm cannot show what it did
What to look for when you implement it
- Ask each cloud provider how deletion works, how long copies remain in backups and how it confirms the result
- Ask the disposal vendor how it handles the data and what proof it gives
- Check that devices with encryption turned on, if the firm uses it, still follow a written disposal step
- Decide who in the firm owns the process, and put it on the departure and device-replacement checklists
- Review the inventory and the retention rules with your attorney from time to time