Which statement describes a best practice for document retention, storage, and disposal?

• A. Define retention periods, securely store or destroy when appropriate, maintain chain-of-custody, and comply with legal requirements.
• B. Store everything indefinitely.
• C. Destroy all records after two years.
• D. Archive all records publicly.

Answer: (A)

Defining how long to keep each type of document, securely storing or disposing of records when appropriate, maintaining a clear chain-of-custody, and ensuring compliance with legal requirements together form a sensible, risk-aware approach to handling records. By setting retention periods, you align with regulatory obligations and business needs, so you don’t keep unnecessary data or discard something you may later need. Secure storage protects information from unauthorized access, damage, or loss, while secure disposal ensures data is responsibly removed when it no longer serves a legitimate purpose. A chain-of-custody keeps a verifiable trail of who handled the document and when, which is crucial for accountability, audits, and potential legal holds. Compliance ensures adherence to privacy laws, industry rules, and contract requirements, reducing legal risk and ensuring you can respond appropriately to requests like discovery or regulatory inquiries.

Storing everything indefinitely creates avoidable risk and costs, and may breach data protection principles. Destroying all records after two years ignores the varying retention needs of different documents and can violate statutory or contractual requirements. Archiving all records publicly would breach confidentiality and access controls, exposing sensitive information.