Retention and Disposition of Records Containing Personal Data

Maturity Level

Privacy Logo

  1. Level 0: Non-Existent

    The practice is not implemented or acknowledged.
    Records are retained indefinitely or disposed of haphazardly.

    Example Strategies

    • Identify individuals who can perform such functions in an ad hoc or as needed basis until permanent individuals are appointed.

  2. Level 1: Ad Hoc

    Practice may occur but is undocumented (no policies or procedures), application is reactive and not standardized.
    Some awareness of retention periods exists, but secure disposition methods are inconsistent or undocumented.

    Example Strategies

    • Establish a basic workflow for departmental shredding.

  3. Level 2: Defined

    Practice is implemented and documented, but documentation may not cover all relevant aspects, and application may be informal and inconsistent.
    Retention schedules are defined, and basic procedures for disposition are documented, but consistent and secure destruction processes may be lacking.

    Example Strategies

    • Dispose of personal data strictly per approved retention schedules.

  4. Level 3: Consistently Implemented

    Practice is documented to cover all relevant aspects, application is formal and consistent.
    Formal policies and procedures for record retention and secure disposition are consistently applied across all relevant record series, fully complying with approved schedules and Utah Code § 63A-19-404.

    Example Strategies

    • Implement "Automated Disposition Alerts" for records officers.

  5. Level 4: Managed

    Practice is actively managed with metrics that are regularly reviewed to assess efficacy and facilitate improvement.
    The entity conducts regular audits of record disposition, tracks compliance rates, and reviews the effectiveness of secure destruction methods.

    Example Strategies

    • Implement "Smart Holds" within automated disposition systems.

  6. Level 5: Optimized

    Practice is fully embedded in the entity with recognition and understanding across the workforce through active training and awareness campaigns, and inclusion in operations and strategy.
    Automated retention and disposition tools are implemented, and data lifecycle management is fully integrated into IT systems, ensuring timely and verifiable secure deletion of personal data.