Records and Information Destruction Guidelines

Once records reach the end of the scheduled retention period, they should be destroyed as prescribed in this document.

PAPER RECORDS

  • Paper records containing private or confidential information require secure destruction procedures that protect individual privacy interests and guard against identity theft (i.e., shredding or otherwise rendering unreadable the confidential paper records). Shredding is the preferred method of destruction for confidential paper records, which can be accomplished by office shredders within units.
  • Paper records containing only public information need only be discarded, preferably in recycle bins.

ELECTRONIC INFORMATION

  • Private or confidential electronic information requires secure destruction procedures so the information cannot be practically read or reconstructed (i.e., overwrite, degauss, or physically destroy the data).
  • Public electronic information may be deleted with simple file or email delete commands.
  • Prior to transfer, decommission, or disposal of memory devices (e.g., hard drives; external storage devices; removable media such as USB drives, CDs, and tapes; mobile devices; etc.), the data stored thereon must be destroyed through data sanitization, degaussing, or physical destruction. For assistance, consult with Information Technology staff.
    • Data sanitization: This process permanently removes data stored thereon. The tools that should be used depend on the type of drive:
      • Encrypted SSDs (solid-state drive), use the secure erase function on the device. Remember to empty the trash.
      • Encrypted hard drives that spin, use reformat.
      • Unencrypted hard drives that spin, use a media sanitization.
      • Mac computers come with encrypted SSDs by default, the secure erase is built in. Remember to empty the trash.
    • Degaussing is a process by which the storage media is subjected to a powerful magnetic field to remove the data on the media. Degaussing may make the media inoperable; therefore, use this method if the media does not need to be reused.
    • Physical destruction is recommended for media and other devices containing sensitive data that cannot be wiped using methods described above. This is done by shredding disk platters, grinding the surfaces off of CDs, incinerating tapes, or cracking/cutting the media.