Records Destruction

At the end of a record's life, the record should be destroyed in an appropriate manner.

Destruction of records should be irreversible and complete to prevent the information from being recovered or reconstructed and ensure there is no risk of accidental or unauthorized access to the records. Confidential records should always be disposed of with the same level of security that was applied during their lifetime and the records to be destroyed should be secured until proper destruction is actually performed.

Destruction of records should be documented because proof of destruction may be required during the course of an investigation, in response to an information access request, or as part of a recordkeeping audit. The type of information to be captured includes the date when the disposal took place, the applicable disposal authority, the records destroyed, and who took the action.

Non-Confidential Records

• Recycle
• Trash

Confidential Records

• Incinerate
• Macerate
• Pulp
• Shred
  • University Facilities provides confidential shred bins to dispose of large quantities of confidential records

Non-Confidential Records

• Erase or delete
• Discard or toss

Confidential Records

• Physically destroy (e.g., crush, incinerate, pulverize, shred) hard drives and removable electronic media devices
• Overwrite existing data with other (often randomized or nonsensical) data or files, making the original data unreadable or irretrievable
• Demagnetize (or degauss) magnetic media to scramble the data and erase it

Disposal of records, regardless of format, relevant to pending or anticipated litigation, claim, audit, agency charge, investigation or enforcement action must be suspended until final resolution of the matter. Employees who are made aware of a legal hold must preserve all records with potential relevance, until receiving official notice that the legal hold is released.