Avoiding a Legal Storm When Storing Records in the Cloud

In the context of electronic records, cloud storage offers equal measures of potential and pitfall. Initially, the idea that your electronic records will be stored off site in a virtual environment made up of networked computers takes a bit of getting used to. Once the concept is familiar, the appeal of storing records in the cloud becomes clear. Specifically, cheap, off-site digital storage that never needs to be maintained and grows effortlessly as your storage needs grow.

However, every records manager worth his or her salt will inevitably ask the million-dollar question: does cloud record storage jibe with our legal obligations for records management?

How the law comes into play.

If you survey the commercial sector legislation in North America, it is full of very specific requirements about how and where certain records and information must be retained. Unfortunately, there is no single set of rules to follow. Certain types of records must be retained in hard copy, whereas electronic formats are acceptable for others. Some records must reside within a specific territory (country, state, province, etc.), and others within a specific business location (head office, work site, field station, etc.). In some cases, these requirements can be waived if the organization is able to ensure speedy and continuous access to the records.

Another important issue to consider when looking at cloud records storage is the issue of legal control. On the surface, the cloud is like any other off-site storage solution – in the sense that it affects the ability of an organization to meet its legal requirements and enforce its legal rights with respect to its records.

However, with cloud there is much more to it. With data and records whizzing around between servers and data warehouses outside an organization’s normal operating jurisdictions, it is much harder for an organization to be sure about its legal obligations and the rights and remedies available to it. For example, if your cloud records ended up in a different jurisdiction to the one in which you normally operate, could you be sure of resuming direct custody and control of those records in the event of contract termination or dispute?

The not-so-quick fix.

All of this means, of course, that knowing the law is essential to a successful cloud records implementation. First, you have to be sure on a case-by-case basis which records are eligible to be stored electronically, and then, which records are permissible to store in which locations. Often, this requires poring over multiple pieces of legislation to be sure you have the complete picture of your organization’s responsibilities and requirements.

Time consuming, yes, but with cheap, scalable storage on offer, the effort is often worthwhile. With this investigative groundwork in place, the next step is just as critical: ensuring that you know everything you can about your prospective cloud storage providers and their policies with respect to data access, movement, etc.

When it comes down to signing on the dotted line, an organization must clearly specify in the contact that it retains legal rights to the records under any number of different scenarios.

In short, get it all in writing and enforce it!

Next Steps

• Download our free white paper and learn how to create a Cloud RM Action Plan that will ensure your organization is ready to store records in the cloud.
• Whether you store electronic records on site or in the cloud, our free assessment tool will show you how to develop an electronic file structure that will keep you compliant with the law.
• If you are concerned about the legal aspects of your organization’s move to cloud records storage, our records professionals can help. Get in touch and tell us about your situation.