How long should you keep digital information?
Unregulated deletion and excessive retention of information can negatively impact business performance, making informed decisions about data retention crucial.
State Records NSW provides retention and disposal authorities that show how long different types of government information must be kept.
Including information retention and disposal rules in system design
Since most government work is done using digital systems today, it’s crucial to consider information retention and disposal rules at various stages, including:
- system design
- system procurement
- system implementation
- moving to cloud services
- negotiating contracts for cloud services
- planning for data portability in cloud services
- outsourcing business processes
- application development
By including planning for retention and disposal of government information at these stages, significant costs and risks can be reduced.
Business risks of not addressing information retention and disposal
- Increased storage costs: Global data volumes are growing exponentially, and all organisations will face rising digital storage costs.
- Management costs: While the cost of storage hardware is going down, the software needed to manage and access information, as well as extra security, search, and discovery charges, mean that the cost of storage is only one component of these increasing long-term costs. Keeping more data requires more management work, leading to higher costs.
- Inability to identify official records: Many businesses have too much information and are unsure which documents are the official versions. This can lead to over retention and failing to discard unnecessary data. Good governance and change management are essential for creating proper disposal practices.
- Risk of data loss from large-scale purging: Poorly designed systems can lead to large amounts of data that don’t match business needs or retention rules. When costs get too high, some organisations might purge data in large quantities, risking the loss of important information.
- High costs of a ‘keep everything’ approach: Some organisations choose to keep all digital information to avoid accidentally deleting anything. This can lead to:
- unsustainable storage costs
- ongoing licensing fees for systems that hold old data
- slower information retrieval
- poor management of valuable information
- difficulties with digital continuity that may become unmanageable in the future
- Poorly managed services: Disregarding retention and disposal considerations can result in unnecessary costs for keeping information that should be destroyed lack of planning for data portability and inappropriate data being deleted by service providers during standard purge cycles.
Get more information on identifying and managing high-value and high-risk records and migrating records: managing source records after migration.
10 years from now, storing all the accumulated data would cost over 20 times as much as it does this year. If storage is 5% of your IT budget this year, in 10 years it will be more than 100% of your budget.
Stanford University computer scientist Dr. David Rosenthal, 2012.
Finding the rules for retention and disposal
The rules governing how long government information should be kept are found in documents issued under the State Records Act 1998, called retention and disposal authorities. These documents reflect business needs for different types of information and wider accountability requirements.
If you need help finding the retention and disposal authorities that apply to your area of business, contact State Records NSW or your organisation’s records and information management staff.
Recommended strategies for effective deployment of rules
- Prioritise information retention and disposal requirements in all system and service decisions.
- Use retention and disposal authorities as active planning tools for system and service decisions.
- Establish strong organisational information governance frameworks that assess business needs and risks across the organisation, and implement targeted information management solutions.
- Encourage collaboration between business, ICT, and records management staff.
- Focus on high-risk/high-value systems and long-term information retention needs Identify systems that need to retain information long-term and create strategies to ensure this information can be accessed and used for as long as legally required.