Data retention

Policy reference

Purpose

This Access Control standard supports APM 65.02 Records Inventory, Retention and Disposition other relevant university policies.

Scope

These standards are for all managed and unmanaged systems that access, store or process University of Idaho data (see APM 30.14 C-6) or using University of Idaho technology resources (see APM 30.12 C-1) at the Low, Moderate- or High risk levels (see APM 30.11) not otherwise covered by an approved systems security plan or investigation and litigation hold.

Documentation of the system and office of record if not currently known is expected to be completed as part of the ongoing data modernization project. This standard may be updated accordingly upon completion of that project.

Standards

1. The UI records retention schedule
  1. The UI records retention schedule is maintained by OIT
  2. The UI records retention schedule follows State of Idaho General Records Retention Schedule with the addition of:
    1. Systems of record
      1. Copies of records outside of the system of record must only be retained while administratively valuable and in approved storage location for the level of risk associated with the record.
    2. Offices of record
      1. The data trustee or data steward will be the Office of record unless otherwise required by University Policy or applicable laws.
  3. Other retention requirements will be used as needed including but not limited to:
    1. State and Federal law
    2. Data management plans
    3. Research requirements
    4. Other contractual requirements
  4. Offices of record must retain records to meet the UI records retention schedule
    1. Offices of record must store records in the appropriate system of record as defined in the UI records retention schedule.
    2. Records covered by the UI records retention schedule must be labelled with the retention label that supports the required retention period where possible.
       
2. Document lifecycle 
  1. SharePoint and OneDrive, including storage sites, individual OneDrive, and Teams Files retention, are configured with a default retention policy of 10 years based on last modified date
    1. Files may be deleted earlier through other means
    2. Exception for files/folders are available through retention labels with the following settings:
      1. Delete after 3-years
      2. Delete after 7-years
      3. Delete after 10-years
      4. Never archive
      5. Retain permanently
  2. Email retention is set to archive email after 2-years by default
    1. Retention labels will be available for the following:
      1. Delete after 3-years
      2. Delete after 7-years
      3. Delete after 10-years
      4. Never archive
      5. Retain permanently
    2. Email archive is not configured to delete items after any period of time
  3. Inactive Teams within Microsoft Teams will be deleted after 400 days, including corresponding shared files
  4. General storage
    1. System owners will be expected to configure cloud storage systems to have at most a 10-year limit for data/documents not covered by the general records retention schedule or otherwise covered by an approved systems security plan or investigation and litigation hold.
    2. Systems owners may configure longer limit with a documented reason.
       

Other References

Definitions

  1. Investigation and litigation holds
    Any record pertaining to anticipated or ongoing investigation, legal action or proceeding, audit, or similar activity as defined by OIT or the Office of General Counsel.
  2. Document
    Any file, physical or digital, that holds university data defined in APM 30.14
  3. Record a.k.a. Public Record
    “Includes, but is not limited to, any writing containing information relating to the conduct or administration of the public’s business prepared, owned, used or retained by any state agency, independent public body corporate and politic or local agency regardless of physical form or characteristics. Provided, however, that personal notes created by a public official solely for his own use shall not be a public record as long as such personal notes are not shared with any other person or entity.”
    (Idaho Code §74-101)
  4. System of record
    The authoritative location for the storage and retention of the relevant records.
  5. Office of record
    “The administrative unit or academic department responsible for managing the relevant records.” (APM 65.02)
  6. Teams Channels & Files
    Files, including posts, from Teams which are stored within M365 Group mailboxes & sites, including channel posts and shared files
  7. Teams Chats
    Chats from Teams which are stored within exchange mailboxes, including direct and group messages but not including shared files, which fall under OneDrive.

Standards Owner

The OIT Information Security Office (oit-security@uidaho.edu)

Revision History

5/28/2026 — Original standard