Something RMs have been talking about for years: that you can outsource the storage of records but not the responsibility for managing records. Organisations still need to know which legal and business requirements apply to their data, in order to fully vet their contracts and agreements - to ensure providers are stepping up to the mark.
This Mondaq article describes a range of USA laws that contain well-recognised records management requirements, and outlines key areas to address in third-party data storage contracts.
"... Under most or all of these laws, even though a business outsources its data storage to a third-party service provider, it does not surrender its legal responsibility to securely store the data. According to some laws, the controls of the service provider effectively become the controls of the business. Other laws specifically state that, when outsourcing data storage, businesses must take reasonable steps to select a provider that will comply with the requirements applicable to the business itself.
In other words, it's not enough simply to outsource data storage to a cloud provider with a good reputation. Special attention is necessary to ensure that the service provider's practices match or exceed those that would be used if the data storage was not outsourced.
When contracting for storage in the cloud, a business should ensure that its agreement with the service provider requires a level of data security at least as strong as its own. As always, the devil will be in the details, so a business should push for concrete details in the agreement about how the storage provider will handle things like infrastructure security, compliance reporting, security auditing, and data storage and access methodologies... Infrastructure security, [physical security measures and logical data access controls] are crucial when storing data in the cloud... "
Read the full article by Will Montague.
Comments