Managing removable media records

Removable media refers to storage devices that can be easily removed from a computer, such as USB drives, memory cards, CDs, DVDs, and external hard drives. These devices allow users to store, share, and transport large amounts of data conveniently.

Last updated: 04 February 2025

On this page

What is removable media?

Removable media refers to storage devices designed to be easily removed from a computer. Examples include older forms like punched cards, tape, magnetic tapes, and floppy disks, as well as modern types such as optical disks (Blu-ray Discs, DVDs, and CDs), memory cards, flash drives, and removable hard disk drives.

Other technologies that utilise removable media include digital cameras, smartphones, Bluetooth devices, and MP3/MP4 players.

The storage capacity of removable media varies based on its type and age, with newer media like flash drives and removable hard drives capable of storing gigabytes of data.

Uses of removable media

There are 2 main ways removable media is used:

  1. for off-line storage within the office environment or at a storage location
  2. to enable data to be copied, moved around or accessed away from the office.

What are the benefits of removable media?

Removable media is cheap, easy to carry and simple to use.

It lets people copy, save, and move large amounts of data quickly. 

Employees can share information easily and use it in different places, which can help the organisation work more efficiently.

What are the risks of using removable media?

Using removable media comes with several risks:

  • Data security: Removable media is portable and has large storage capacity, making it easy to copy or remove sensitive corporate data without being noticed. This threatens the confidentiality and availability of information.
  • Loss or theft: Devices can be lost or stolen easily. Without security controls, this can result in breaches of laws like privacy regulations.
  • Viruses and malware: Removable media can introduce harmful software or inappropriate content, disrupting business operations.
  • Unauthorised access: Removable media may come into the possession of people who access and use the data with ill intent, compromising security and public safety. 
  • Limited access: Data stored on removable media may not be available to everyone in the organisation, creating information "silos."
  • Duplicate records: Data copied onto multiple devices may cause confusion about which version is the original.
  • Retention issues: It's difficult to manage the legal disposal of data on removable media, often leading to keeping unnecessary information, which adds costs and risks. 
  • Search challenges: Locating corporate information on removable media for legal or access requests can be complicated and time-consuming.
  • Backup problems: If removable media is the main storage for information, it may not be backed up regularly. Changes made to the media might not sync with other records, creating multiple versions.

Additional risks of using removable media for long-term record storage

Using removable media for long-term storage of digital records poses extra risks:

  • Short lifespan: CDs, DVDs, and USB sticks may degrade quickly if not stored in ideal temperature and humidity conditions.
  • Easily damaged: Physical damage, such as scratches or exposure to magnetic fields, can make data unreadable.
  • No central backup: Data on removable media isn't centrally backed up, increasing the risk of loss.
  • Poor labelling: Inconsistent or unclear labelling makes it harder to locate and reuse information.
  • Lost access: Encryption keys or passwords can be misplaced over time, locking out access to data.
  • Obsolescence: Removable media is often overlooked during technology upgrades or migrations, leading to outdated and unusable formats.

Is removable media suitable for storing backups?

Removable media can be suitable for storing backups when used for short-term disaster recovery purposes. However, it is essential to implement security measures to protect the data.

Measures to protect information on removable media

Removable media poses security risks, but organisations can take steps to manage and reduce these risks effectively:

Risk assessments

  • Include removable media risks in organisational risk assessments.
  • Clearly define risks and implement treatment measures.

Policies and procedures

  • Develop policies and procedures for managing removable media as part of the organisation's security framework.
  • Address topics like approved media types, data removal when no longer needed, encryption, and physical security.
  • Communicate these policies to employees and ensure they understand their responsibilities.

Access controls and security

  • Protect sensitive or confidential information with strong access controls.
  • Train employees in appropriate use and security measures.
  • Implement physical restrictions, such as preventing unauthorised devices from being used.

Technical measures

  • Use password protection, encryption, and locking mechanisms.
  • Configure systems to log or restrict data transfers.

Auditing and testing

  • Conduct periodic audits to test and improve controls.

Additional protection for long-term preservation

Proper management of removable media is crucial to safeguard information and reduce risks. The following measures outline best practices for policy integration, storage, maintenance, and labelling.

Policy integration

  • Include guidelines on removable media in the organisation’s records management policy.
  • Use removable media only as a last resort for long-term storage.

Storage and handling

  • Specify optimal environmental conditions for storage.
  • Define handling requirements and ensure disaster management copies are created.

Regular maintenance

  • Assign responsibilities for monitoring and safeguarding removable media.
  • Implement schedules for refreshing, replicating, or migrating data.

Labelling and metadata

  • Clearly label removable media with content descriptions.
  • Include metadata and encryption requirements to ensure accessibility over time.

By implementing these measures, organisations can minimise the risks associated with removable media and ensure information security and accessibility.

Further advice

For further information on the protection and handling of removable media, see:

Download as PDF Print this page
Top of page