Retention Schedule Proposal and Approval

Maturity Level

Privacy Logo

  1. Level 0: Non-Existent

    The practice is not implemented or acknowledged.
    No retention schedules exist or are followed.

    Example Strategies

    • Identify individuals within the entity to begin identifying records series with no retention schedules or outdated schedules.

  2. Level 1: Ad Hoc

    Practice may occur but is undocumented (no policies or procedures), application is reactive and not standardized.
    Informal retention practices might exist, but schedules are not formally proposed or approved by the Records Management Committee.

    Example Strategies

    • Identify applicable General Retention Schedules.

  3. Level 2: Defined

    Practice is implemented and documented, but documentation may not cover all relevant aspects, and application may be informal and inconsistent.
    Retention schedules are drafted and may be submitted for approval, but their implementation might be inconsistent, or they may not fully align with privacy principles (e.g., data minimization).

    Example Strategies

    • Obtain RMC approval for all entity-specific retention schedules.

  4. Level 3: Consistently Implemented

    Practice is documented to cover all relevant aspects, application is formal and consistent.
    Retention schedules are consistently proposed, approved, and adhered to for all record series, with documented procedures for secure disposition.

    Example Strategies

    • Track "Defensible Deletion" completion rates.

  5. Level 4: Managed

    Practice is actively managed with metrics that are regularly reviewed to assess efficacy and facilitate improvement.
    The entity monitors compliance with retention schedules and secure disposition, using metrics to identify and address any deviations or areas for improvement.

    Example Strategies

    • Automate the permanent disposition of data upon expiration.

  6. Level 5: Optimized

    Practice is fully embedded in the entity with recognition and understanding across the workforce through active training and awareness campaigns, and inclusion in operations and strategy.
    Retention schedules are an integral part of the entity's data lifecycle management, with automated systems facilitating timely and secure data disposition, and regular reviews ensure alignment with evolving privacy laws.