I would slightly disagree with Doug's premise with my understanding that the
majority of regulatory retention requirements, though not all, require
retention but do not mandate a specific disposition at that time. In other
words, an organization may be required to keep something 7 years, or event +
10 years, or whatever, but it is not generally prohibited from keeping it
*longer*; it just tends not to because of the potential cost to store it and
to produce it for discovery or audit.  

Don't we generally look at the required retention as a combination of any
hard, black-letter legal requirements PLUS the organization's legitimate
business requirements, with the longest being the retention that is actually
used? Again, assuming no statutory requirement to explicitly destroy. 

So what happens in practice I think is that things with a shorter mandated
retention are grouped with things that have a longer retention, such that
there is regulatory or legal problem. It means that the organization is
*technically* keeping things longer than it needs to, and with an attendant
increased risk of liability, of having to produce it, etc. But the balancing
act that I see is that the cost of developing the exacting buckets and the
cost of getting users to use them and the cost of fixing what users screw up
is (or is perceived to be) MUCH higher than the potential marginal increase
in cost and/or liability. So for some organizations 5 might, indeed,
suffice. For others maybe it's Brian's "medium-sized" buckets that are
easier to manage but not as broad in scope as the 5. 

Your mileage may, of course, vary. 

Regards, 

Jesse Wilkins
[log in to unmask] 

List archives at http://lists.ufl.edu/archives/recmgmt-l.html
Contact [log in to unmask] for assistance
To unsubscribe from this list, click the below link. If not already present, place UNSUBSCRIBE RECMGMT-L or UNSUB RECMGMT-L in the body of the message.
mailto:[log in to unmask]