Google Vault retention catch 22

[TwistedHelixis]

This is the issue as I see it.

 

Say that we need to retain one type of email or document for 1 year and another type for 10 years. We can't set a retention period of less then 10 years as the system would go in and delete any emails or files we need to keep for 10 years. So we have to set the retention to 10 years. The school doing what they should do, manually delete the emails or documents that need to be removed after one year, except Google Vault has been set to keep all emails and documents for 10 years, so those documents that have been deleted after one year will still be kept in Vault for 10 years, it's a catch 22.

 

Advice please

Edited May 23, 2019 by TwistedHelixis

[Ditto]

I doubt GDPR/DPA will have a concern about the technological challenges - but it remains a challenge at an operational level.

[TwistedHelixis]

but it remains a challenge at an operational level

That is an understatement.

 

I do not see how anyone can be compliant if they keep backups for disaster recovery, seeing as some data is required to be deleted instantly.

[gtg93]

Set data retention to 1 year and anything that needs keeping for longer the user needs to save a copy of locally (locally on the network, not the PC of course)?

 

 

That is an understatement.

 

I do not see how anyone can be compliant if they keep backups for disaster recovery, seeing as some data is required to be deleted instantly.

 

 

I seem to recall backups were OK from memory?

[TwistedHelixis]

Set data retention to 1 year and anything that needs keeping for longer the user needs to save a copy of locally (locally on the network, not the PC of course)?

 

I still cant see that working. Firstly we are 90% cloud based. If I set all emails and documents to delete after 1 year, not only will that delete our website but who knows what. There are so many documents that legally need to be kept for longer that all I can see happening is the school losing everything it needs to keep.

 

I seem to recall backups were OK from memory?

I seem to remember this, but think it might only be in regards to the right to be forgotten and not data retention.

 

Just had a thought, I could disable Vault completely, set the backups to delete after xxx time. I would need to have a long hard think about this as an option as Vault does tick other compliance rules.

 

What does everyone think?

Edited May 24, 2019 by TwistedHelixis

[gtg93]

I still cant see that working. Firstly we are 90% cloud based. If I set all emails and documents to delete after 1 year, not only will that delete our website but who knows what. There are so many documents that legally need to be kept for longer that all I can see happening is the school losing everything it needs to keep.

That's a fair point - if you're relying on cloud storage that much it's kind of a step backwards...

 

 

I seem to remember this, but think it might only be in regards to the right to be forgotten and not data retention.

I seemed to recall that as long as you was making sufficient effort to remove the documents from active storage, it was deemed unreasonable to expect it be removed from backup media. But maybe I'm speaking from what would make sense from an IT view rather than DP view.

 

 

Just had a thought, I could disable Vault completely, set the backups to delete after xxx time. I would need to have a long hard think about this as an option as Vault does tick other compliance rules.

 

What does everyone think?

I'm not familiar with vault, however would that not then rely on staff deleting the files themselves after x amount of time? Is it not possible to exclude a particular folder?

[TwistedHelixis]

Just noticed that in Vault they have added the ability to delete items that are older than xxx that are within a specified Team Drive. Nothing like that for Emails that I can see, and it is the emails I am more concerned about.

[TwistedHelixis]

I'm not familiar with vault, however would that not then rely on staff deleting the files themselves after x amount of time?

 

This is just a very small primary school, they only have a few folder locations in their Team Drives (Office, Staff, Pupils, Governors, Photos, SLT) so the staff have been deleting items themselves.

 

I am starting to think it might just be simpler to disable Vault.

[TwistedHelixis]

Just created a new post asking about disabling Vault - http://www.edugeek.net/forums/cloud-services/206903-anyone-using-g-suite-but-not-using-vault.html#post1769242

[Ditto]

This might be applicable to the other threads also, but a couple of things I think it is worth reviewing.

Firstly, Vault should not be relied upon as a backup tool. Although a slightly marketing style article have a look at https://www.cloudally.com/google-vault-backup-solution/

Also, what you do with staff/pupil accounts after they leave is important. See https://support.google.com/vault/answer/2539616?hl=en - some good insights in this FAQs on Vault.

[TwistedHelixis]

Firstly, Vault should not be relied upon as a backup tool

 

We already have Spanning backup :0)

 

Also, what you do with staff/pupil accounts after they leave is important. See https://support.google.com/vault/answer/2539616?hl=en - some good insights in this FAQs on Vault.

 

Thanks, I have already read through these Google pages but it does not really answer some of my specific questions.

[Ditto]

Does the backup include emails? As much as vault has on a few occasions been a useful tool, I agree there is an issue around retention of emails, or at least being able to control different retention periods for different emails. Do you suspend or delete accounts for leavers?

[TwistedHelixis]

Does the backup include emails?

Yes Spanning backup includes emails, calendars, Drive / Team drive and sites in its backup.

 

Do you suspend or delete accounts for leavers?

Suspend accounts for a while and then delete

[enjay]

Just noticed that in Vault they have added the ability to delete items that are older than xxx that are within a specified Team Drive. Nothing like that for Emails that I can see, and it is the emails I am more concerned about.

 

Would it be feasible to set a one-year retention on most Team Drives and set a ten-year on just one, then have staff export relevant emails as PDFs into that 10-year Team Drive?

[TwistedHelixis]

Its OK, I have just realized I was not able to see all the Vault options. Clicking on the date range when creating a retention brings up all the other options.

 

I feel really stupid now.

 

moving on - What is a recommended period of time to keep deleted emails and documents hanging round in Vault?