In a previous post, we explored data’s importance as a strategic asset and how that has affected the way we approach modern data security. Today, we’re pulling that thread a little further to unravel the importance of data lifecycle management and understand why this critical function cannot be left to the IT team to handle in isolation.
The importance of Data Lifecycle Management
Data lifecycle management (DLM) is the process of managing data from the moment of its creation all the way through to its eventual permanent deletion. Well-designed and well-implemented DLM policies with technical controls make it possible to ensure organisational data is:
- retained to meet industry standards,
- deleted to comply with privacy regulations,
- and retained/managed/deleted beyond the scope of these requirements to:
- support strategic business use,
- improve data usability,
- optimise storage costs,
- and reduce data-related risk.
These benefits span the entire organisation. The only catch is that unlocking their full potential requires input from across the organisation as well. Everyone from HR, to legal, to compliance/risk, to business operations will need to provide input if your DLM policies are going to achieve optimal results.
How to get a Data Lifecycle Management policy off the ground
Microsoft Purview’s Data Lifecycle Management solution provides all the tools and capabilities you need to get the foundations of a DLM policy laid. In addition to following Microsoft’s recommended DLM process, however, we’d also strongly suggest doing the following:
Gather all the relevant stakeholders
As we mentioned above, effective DLM requires input from across the business. The most effective way to get this input is to gather the necessary stakeholders together for a face-to-face (or screen-to-screen) discussion.
Level the playing field
Not all stakeholders will have the same level of understanding of DLM’s purpose, importance and methodologies. As such, it can be valuable to clarify these details before decision-making begins. Key points to cover include the importance of retention and disposition of the various data types within each business unit, and any legal and/or business requirements that apply.
Don’t forget archiving
Archiving is frequently overlooked during DLM discussions, but can be extremely useful in keeping storage and/or licensing costs down for low- or no-touch data that needs medium- to long-term retention. Remember to explore these options as part of your DLM strategy.
Prioritise Locations
Taking a location-based approach for retention controls can provide the opportunity to gradually assess the operational and technical impacts.
Combine Implicit & Explicit Retention Controls
Taking an incremental approach including both retention policies and retention labels. Progress from manual and default to auto-applied over time.
Principals of Retention
Understand the Microsoft principals of retention to determine how long an item will be retained for and when it will be deleted based on all retention controls applied to it.
Microsoft has a flow chart that can be used to determine when and will be retained or permanently deleted.
https://learn.microsoft.com/en-us/purview/retention-flowchart
Ask the experts
Your questions answered by our experts.
Can I set up retention policies if we don’t have sensitivity labels applied?
Retention policies can be applied to files in response to a specific sensitivity label, but can also be applied more generally across users, user groups and/or folders. In other words, yes – you can apply retention policies without needing to have sensitivity labels rolled out across your entire organisation.
