ScheduleOne

Resources · Implementation

Running a disposal routine people will actually follow

A schedule that says 'destroy after seven years' only works if someone does it. How to build a disposal routine that happens, and that you can show happened.

ScheduleOne2 min read

Most organisations have a rule for how long to keep records and very little process for letting them go. Records pile up, personal information is held long after it is needed, and the schedule becomes a document nobody follows.

Make disposal a routine, not a project

The disposal that works is boring and regular. Choose a rhythm, such as quarterly or yearly, and a person responsible. On each cycle:

  1. Identify what has reached the end of its period for each record class.
  2. Check for anything that should be held back (a legal hold, an open dispute, an audit, a records request).
  3. Approve the disposal. A named person signs off, not whoever happens to run the report.
  4. Dispose in a way that suits the record.
  5. Record what was done.

Match the method to the record

Disposal isn’t one thing. Paper, files on a shared drive, database rows, emails and backups all behave differently. Think about:

  • Destroy or de-identify. The privacy duty is to destroy or de-identify personal information that is no longer needed. De-identification can suit data you want to keep for analysis, but it has to be real: information that can be re-identified hasn’t been de-identified.
  • Secure destruction. Paper and devices that held sensitive records should be destroyed so the contents can’t be recovered. A skip bin is not a disposal method.
  • Copies. A record exists in more places than you think: exports, email attachments, local downloads and backups. Disposal that misses the copies has missed the record.
  • Suppliers. If a supplier holds records for you, your routine has to reach them, with a way to confirm what was done.

What makes it fail

  • No owner. The routine depends on someone’s memory.
  • No trigger. If the start point isn’t recorded, nobody can say which records are due. See why the start point matters.
  • Fear of deleting. People keep things “just in case” because nobody will take responsibility for approving disposal. A clear approval step, with a legal hold check built in, makes it safe to say yes.
  • Backups. Systems that can’t delete from backups need a defined approach, such as a stated backup cycle after which deleted records are gone.

Show that it happened

A routine that isn’t recorded can’t be shown to an auditor, a regulator or a court. See evidence of disposal.