Retention and Deletion
Data Retention Policy
Consider how long you need to keep all the different types of personal information for. Once you have
decided on the timeframes for deletion, publish a policy and ensure all staff know about it and allow
them time to implement it.
Data Disposal Procedures
Effective data disposal is how a retention policy is implemented in practice. It is essential to prevent
unauthorised access to sensitive data once it is no longer needed.
•
Secure file deletion tools: Use free or low-cost software that permanently deletes files by
overwriting them multiple times. This prevents data from being recovered through file recovery
tools. Examples include:
* Eraser (for Windows)
* BleachBit (for Windows and Linux)
* File Shredder (for Windows)
•
Simple reformatting: For non-sensitive data, a quick reformatting of USB drives, memory cards,
or external hard drives may suffice. This method wipes the file structure, though it’s not as secure
for sensitive data.
•
Low-cost benefits: Reformatting can be done using built-in tools in most operating systems
(Windows Disk Management, macOS Disk Utility), making it cost-effective.
•
Device dismantling: Open hard drives and physically remove and damage the disk platters.
SSDs, which store data differently, can be destroyed by damaging the memory chips.
For data stored in the cloud, ensure staff understand how to permanently delete files. Most cloud
providers (e.g., Google Drive, Dropbox) allow users to delete files and empty the trash folder, ensuring
data is no longer accessible.
•
Low-cost third-party services: For larger data disposal needs, such as disposing of old computers
or hard drives, consider partnering with a certified data destruction service. These services
securely erase or physically destroy storage media. Many providers offer affordable, one-time
services for NGOs.
•
Certificate of destruction: These services often provide certificates of destruction, which may be
useful for regulatory or auditing purposes.
Data Protection Guidelines for NHRIs Toolkit
23