Data Repositories Without Automation Pose Significant Organizational Risk, Says Info-Tech Research Group

News provided by

Mar 16, 2023, 11:00 ET

A retention schedule is essential but does not guarantee protection from retention-related risks.

TORONTO, March 16, 2023 /PRNewswire/ - The amount of data organizations produce daily is staggering, and many IT leaders struggle to manage the ever-increasing volume. As a result, the unnecessary retention of sensitive data has led to a challenge in maintaining compliance obligations. As these issues continue to grow, organizations may find it challenging to identify where the greatest data risks lie. To help guide IT leaders in managing unstructured data sprawls and risks, global IT research and advisory firm Info-Tech Research Group has published its industry blueprint Build an Effective Data Retention Program.

A framework to reduce data retention risks, from Info-Tech Research Group's "Build an Effective Data Retention Program" blueprint. (CNW Group/Info-Tech Research Group)

"Data retention is a challenge for many organizations. Ideally, it would be great if the business could fully automate records retention and deletion and never think about it again," says Logan Rohde, senior research analyst at Info-Tech Research Group. "Even organizations that do data retention well are often forced to use some semi-automated or manual processes to adhere to their retention schedules. In other words, there is no perfect solution to resolve data-retention challenges once and for all."

The firm's research outlines how data retention requires full-time staff resources, but it often receives less than part-time hours. Thus, organizations do not have the resources allocated to validate whether the data retention schedule is being followed.

Info-Tech's data-backed blueprint suggests that the best approach to resolving the difficulties of building an effective data retention program is to identify the organization's retention requirements, develop a retention schedule, and then develop a risk profile for its data processes and types. While a retention schedule won't ensure retention-related risks are managed effectively, the key lies in identifying risky data and finding solutions to reduce them.

Effective data retention offers several benefits, such as reduced physical storage costs, by balancing retention requirements with the ability to purge unneeded data. It also provides increased insight into risky data processes, types, and repositories. To help organizations build an effective retention plan, the firm advises IT leaders to consider the following factors:

1. Requirements

Retention Laws and Regulations: Some laws and regulations will mandate retaining data for a minimum period, which must be reflected in the retention schedule.
Minimization Laws and Regulations: Laws like GDPR will force delete data once its usefulness has expired. Usefulness is an open-ended term but does not include indefinite retention.
Business Needs: Business needs are a broad category ranging from future R&D to retaining data with legal defense needs in mind. Regardless of the need, it carries a risk.
Data Types: For retention to work well, businesses need to bundle records based on similarity.

2. Governance

Successful data retention is closely linked with security governance, compliance, and data classification. However, most organizations struggle to establish a reliable data retention schedule without these guardrails.

3. Enforcement

IT leaders need to determine which data types carry the highest retention-related risk and prioritize data processes, types, and repositories that need retention-risk remediation tactics applied.

Info-Tech's blueprint advises that organizations be beware of conflicts in their obligations. Some regulations and laws dictate that data must be retained, while others demand that data be deleted once it is no longer in active use. Therefore, IT leaders need to make a judgment call regarding the right retention period, which should be done in conjunction with the legal counsel.

To learn more about the research and recommendations, download the complete Build an Effective Data Retention Program blueprint.

For more information about Info-Tech Research Group or to access the latest research, visit infotech.com and connect via LinkedIn and Twitter.

About Info-Tech Research Group

Info-Tech Research Group is one of the world's leading information technology research and advisory firms, proudly serving over 30,000 IT professionals. The company produces unbiased and highly relevant research to help CIOs and IT leaders make strategic, timely, and well-informed decisions. For 25 years, Info-Tech has partnered closely with IT teams to provide them with everything they need, from actionable tools to analyst guidance, ensuring they deliver measurable results for their organizations.

Media professionals can register for unrestricted access to research across IT, HR, and software and over 200 IT and Industry analysts through the ITRG Media Insiders Program. To gain access, contact [email protected].

SOURCE Info-Tech Research Group