This issue comes up from time to time on all of the records management
Listserves. We recently had such a debate on RECMGMT-L over here in the
States.
First off, you need to properly define terms. A "backup" is just that
-- a backup that is used solely to recover lost data in the event of a
disaster. It is not in place for any other purpose and it is
particularly not in place to serve as a record of transactions. This
does not in any way mean that the tapes are not discoverable, nor does
it mean that they cannot be used as evidence -- it simply means that
they are backups and not the record copy of the information.
If you are periodically taking snapshots of a particular system and
intending to retain those snapshots or data subsets as a record, we
like to call those "archives" of the system. Archives should have
retention periods, but those retention periods should be tied to the
retention period for the system. In some instances, organizations will
retain data that has been purged from the main database. The retention
period is then based upon when the data was purged from the system.
Just like the arguments that we get into over email, you should never
refer to a record series as "archives" or "backups". We would not call
"paper" a record series. The informational content drives the retention
period. You should have a policy governing how backups are created and
preserved, but you likely should not have it listed on a retention
schedule. What you do want to ensure is that the policy on backups is
being followed and documented. (In other words, you don't want someone
to be holding on to backup tapes haphazardly -- they should be rotated
through the process on a standard, regular basis.)
As far as backups go, you should create and retain them for as long a
period as your IT department is comfortable. In many cases that is 30
to 90 days, depending upon the backup methods and protection. What you
want offsite are sufficient copies to ensure that you lose no more than
a few days of data -- but enough copies that you have some fallbacks if
the restore fails. You should also take measures to ensure that the
tapes (and the process) are tested from time to time to ensure that
they can properly restore data.
One further consideration is retention of data from file systems or
email systems. Since this data may contain numerous record series, it
is critical that you avoid retaining backups for an overly long period
of time. If you consider your active storage system as the record copy,
then the backup tapes should just be that -- backups retained for a
brief period of time in the event of a disaster.
Now all of that said, there may be laws or regulations that require you
to manage your data differently, but the guidelines above should
suffice in most instances. But clearly the first step is to define the
purpose for retaining the data.
Patrick Cunningham, CRM
[log in to unmask]
"Those who would give up essential liberty to purchase a little temporary safety deserve neither liberty nor safety."
Benjamin Franklin, Historical Review of Pennsylvania, 1759
|