Data Destruction Awareness and You
- Classify Your Data
- Determine Retention Schedule
- Determine Historical Value
- Disposal of Data
One of the first steps to take in properly disposing of University data is to determine what type of data you have. At Purdue University, data is classified as either 1) public; 2) sensitive; or 3) restricted. The classification of the data that you have dictates the type of disposal method for that data.
The University's Data Classification definitions are available here.
In addition, many areas of the University have already classified the unique data owned and used by that area. To see if your area has already classified a particular type of data, you can visit this page to see a list of administrative areas. You can view information provided by each area listed to learn more about the classification of data that the area owns and uses.
At Purdue University, Social Security Numbers area always considered restricted data.
Once you have determined the classification of your data, you need to be sure that it is not subject to any retention periods. Federal and state laws and regulations, requirements of accrediting and other external agencies, and prudent management practices govern the retention and disposal of University records. University records must be retained appropriately and disposed of in a timely manner to meet the requirements of external regulations. The University's records retention policy is available here. If you are unable to determine the retention period for data in your possession, you can ask your supervisor or the University's Public Records Officer for more assistance.
After you have determined that data in your possession is not subject to any retention period, it is important to evaluate whether it has any historical or archival purpose for the University. In some instances data ready to be disposed may contain information with enduring legal, fiscal, research, or historical value for the University and should be retained and preserved indefinitely. Oftentimes these types of documents are fundamental to documenting and preserving the historical development of the University. This document can help you learn more about the types of documents that may have archival value. Employees with questions regarding data that may have archival value are encouraged to contact the University Public Records Officer or the head of Archives and Special Collections for additional information before disposing of such data.
Finally, after data in your possession is classified and reviewed for retention and archival purposes, and it is determined that the data can be properly discarded, the last step is to dispose of your data in the appropriate manner.
- Paper Media
Paper media needs to be disposed of in accordance with the University's Data Handling Requirements. Documents with University sensitive or restricted information must be physically destroyed.
The University offers both general paper recycling as well as a confidential paper recycling program. General white office paper recycling receptacles are green. Confidential paper recycling receptacles are blue and have a locked top (also known as "blue barrels"). If you are disposing of paper materials containing University sensitive or restricted materials, you must use a confidential recycling receptacle or otherwise destroy (i.e., shred) those documents. Your building deputy can tell you where recycling receptacles are located.
If your building deputy has not setup the confidential recycling service then they need to contact Work Control Center to setup service by emailing email@example.com. Once service has been established each department needs to select a representative as the point of contact.
You will begin the "blue barrel" program once the service is setup. By participating in this program, you are securing confidential data and having it destroyed according to University policy.
There is no charge to the cart itself, but there is a small charge for the shredding of the material: around $.11 per pound. The material is shredded by an outside vendor.
It is important to note that departments are responsible for the security of the blue barrels. Blue barrels that are left in an uncontrolled space are easily compromised, potentially resulting in an information security breach that the University may have to respond to.
For more information read the document destruction operating plan available here.
- Electronic Media
What is Electronic Media? In this context it is anything that stores any electronic data. It includes things like hard disk drives, floppy disks, flash or thumb drives, CDs/DVDs, Jazz Disks, Zip Disks, Tapes that have been used perhaps for archival or backup storage. Tapes from old 9-Track, Exabyte (8mm), QIC, DLT, LTO, etc. Electronic media also includes the storage devices in multi-function machines such as copy machines, printers, fax machines, and scanners.
Electronic media needs to be disposed of in accordance with the University's Data Handling Requirements. Electronic media with University data on it must be physically destroyed. This means that not only must the data be destroyed beyond any ability to recover that data, but the physical media device (such as a jump drive, CD or DVD, or tape, etc.) must also be destroyed. Electronic media that has had University data on it may not be sold or given to anyone outside of the University.
Some types of electronic media may be disposed of using the "blue barrel" program. Microfiche and non-paper media such as computer disks (CDs and DVDs) may be handled through the confidential paper recycling program provided these are kept separate from the paper materials. A small confidential cart may be requested for this type of material.
Physical Facilities began offering an electronic storage media shredding service in fall 2009. "Recycling for the Future" is a collaborative effort between Materials Management and Distribution, University Warehouse and Surplus, and ITaP's Secure Purdue initiative.
The "Recycling for the Future" program offers a systematic, auditable, and reliable process for the disposal of electronic storage media containing University data. These media are shredded with a high-powered shredder at the University Warehouse and the shredding byproducts are disposed of in an environmentally friendly manner by contractors that handle e-waste. Items that can be destroyed using the new shredder include hard drives, disk arrays, USB keys, CDs, and DVDs, among others.
The new program ensures that hard drives and other electronic storage equipment that previously stored University data will no longer be offered for sale to the general public at the end of their useful lives. All such equipment will be destroyed and disposed of through the program.
To learn more about the "Recycling for the Future" program, or for more information, contact Mark Schock, supervisor of the University Warehouse and Surplus operations, at 742-4414. You can also visit http://www.purdue.edu/surplus and click on the "Recycling for the Future" link on the bottom of that page.
To read the University news release on the "Recycling for the Future" program, visit: http://news.uns.purdue.edu/insidepurdue/2009/090629_shred.html."
If you have any electronic media that you no longer need, you should talk to your local IT support staff to determine how best to destroy it.
- Paper Media