A file can be technically accessible and still be in the wrong place. Before changing storage or permissions, establish who owns the information and what the organization needs it for. Include paper records, email, exports, recordings, cloud applications, and copies on endpoints.
Follow the information beyond its main home
Ownership and permitted handling apply to exports and endpoint copies as well as the source system.
Follow the information
Describe how information arrives, who uses it, where it moves, and which outside organizations receive it. Give sensitive records handling rules that staff can apply in ordinary work. For example, the destination for a personnel document should be clear before someone attaches it to a support request or AI prompt.
Agree the information classification and handling rules with the people accountable for the records. The label should tell staff what they may do with the information, including where it may be stored and who may receive it.
Access should follow an approved role and a business reason. Review shared links, guest access, inherited permissions, and administrator privileges. The file collaboration guide explains why individual working files and departmental records need different ownership arrangements.
Retention is a business decision
Identify the applicable records schedule, contract, legal hold, and regulatory obligations before choosing a deletion period. Different records can require different treatment. A product’s default retention period is not the organization’s records policy, and a backup is not automatically an archive. The records-retention guide follows that decision through settings, copies, and disposal.
The FTC’s personal-information guidance recommends understanding information holdings, limiting unnecessary collection, protecting retained information, and planning disposal. Specific legal duties still depend on the organization and records involved. The existing Massachusetts, HIPAA, and CJIS guides address particular environments without assuming they apply to everyone.
Translate the authorized policy into storage, permissions, recovery, and documented procedures. Record who authorizes deletion and what evidence confirms it. Include those requirements when selecting a vendor and when preparing a cloud exit, so information ownership survives a product change.