Database Records Retention and Disposition
How are Database or Information Systems records defined?
1. The database or information system itself is nota single record.
2. Databases/systems contain many records.
a. And possibly multiple record series.
3. Retention and disposition should be appliedroutinely per university retention schedules.
a. Be careful not to break relational fields
within the database when deletingrecords.
4. How is a record defined in the system?
Example: Online Job Application

Record (Ohio Revised Code 149.011G)"Records" includes any document, device, or item,
regardless of physical form or characteristic, including anelectronic record as defined in section 1306.01 of theRevised Code, created or received by or coming under thejurisdiction of any public office of the state or its politicalsubdivisions, which serves to document the organization,functions, policies, decisions, procedures, operations, orother activities of the office.

Record SeriesGroup of records that are created for the same purpose andgenerally contain the same types of information.

Job applications, whether in paper or online, ask for the same information, such as name, email address,
phone number, experience and education. Each applicant fills out each piece of information, or fields ofdata, and the information is grouped or tied together by applicant.
On paper, the data for each of the fields are all grouped together in a single document. In a database,each piece of data may be in a separate cell labeled by field, but all data fields for a single applicant are
tied together to form that person’s application, or record.
Whether in paper or a database, the information is grouped together for the same purpose: tounderstand each applicant’s qualifications for the job. This grouping of data for an applicant is therecord. All of the employment applications taken together is the record series.

09.15.2022

1v1.0

How long must Database or Information Systems records be kept?
As with any Ohio State records, databases or information systems retention and disposition depends onthe function and content of the record, not the format or security level.
To determine how long to keep database or information systems records, start by reviewing theUniversity General Records Retention Schedule or view the unit-unique schedules to determine which
record series are contained within the database. Record series within university retention schedules:
1. Describe the purpose and/or function of the record (how you use the database record)
2. Tell what types of information are found in the record (content captured in the database record)
3. Explain how long the record must be kept.
If a record series cannot be found that fits with the records held within the system, contact University
Records Management to update the retention schedule.

Is it acceptable to keep Database or Information Systems records indefinitely?
NO: Database records should be managed just as any other type of records are managed; they should besecurely destroyed when retention has been met, as long as deleting the record does not negatively
impact other records in the database. Without periodically deleting database records that have met
retention:•••

It becomes more difficult to locate records for business purposes, public records requests,investigations, or litigation.
Too many unnecessary records impact the performance of the database or information system
and may be costly in staff time and expenses for to maintain or migrate.
The number of records affected during a security/privacy incident and the cost of responding toand recovering from the incident increases.

Records disposition should be a routine process conducted at regular intervals, not just when the system
is being decommissioned or the contract with the vendor is expiring.
A Certificate of Records Destruction must be submitted to University Records Management for approval,
a minimum of 1 week prior to deleting database records for manual disposition. If the system has
capabilities to automate disposition, contact University Records Management to work out a plan for
documenting disposition in a manner that will meet legal requirements.

Changing or Decommissioning Database or Information System Software
Before decommissioning or changing databases or information systems, review the records todetermine:

09.15.2022

2v1.0

1. Which records have met retention (should be deleted, not be migrated).
2. Which records still need to be maintained per retention schedules (should be migrated orexported).
3. Perform an analysis of the specific data fields that form the records to ensure that:a. no relationships will broken by deleting data that has met retention
b. fields needed to query for records that have met retention, often date fields, are notaltered during the migration.
Contact University Records Management prior to deleting records or migrating to a new system toensure that the records retention and disposition policies can be appropriately met.
A Certificate of Records Destruction must be submitted to University Records Management for approval,
a minimum of 1 week prior to deleting database records.

Procuring New Database or Information System
When evaluating potential new software, ask questions about how the system can routinely delete
records at the end of their retention period. This goes beyond ensuring that the vendor has a policy fordeleting data at the end of your contract. Ask questions such as:•••••Can the system be programmed to automatically delete records in accordance with ourretention schedules?
Is manual deletion done by the customer or company?
Can different record series be deleted on different retention periods?
How can we set up queries to determine which records have met retention?
o What fields can we query for flat retention periods (3 years, 5 years, etc.)?
o What fields can we query for event-triggered retention periods (3 years fromseparation, 3 years from grant close-out, etc.)
Is there a report that can be run that provides information on the disposition? What type ofinformation does the report include?

University Records Management is willing to meet with units and vendors to talk through questions andfunctionality relating to the disposition of records.

University Records Management
Pari J. Swift
University Records Manager
Swift.102@osu.edu
614-292-4092
Records Management Tip Sheets and Guidance

09.15.2022

3v1.0