Data Retention Policy

Purpose: To outline the practices and procedures for retaining, storing, and sharing data collected and processed by Pittsburg State University (PSU). It ensures compliance with legal, regulatory, and business requirements while safeguarding the confidentiality and integrity of data.

Applies to: To all employees, contractors, and third-party partners of PSU. This policy applies to all university colleges, departments, administrative units, and affiliated organizations. For the purposes of this policy, affiliated organization refers to any organization that uses university information technology resources to create, access, store, or manage University Data. It covers all data, regardless of the format (electronic, physical, or otherwise) or media.

Policy:

Data Retention Guidelines

Retention Periods:  All data will be retained only for as long as necessary to fulfill the purposes for which it was collected, or as required by law or regulatory obligations.

PSU follows the State of Kansas record retention schedules. Schedules are available at the following link under the heading "State General Schedule": http://kshs.org/recmgmt/retention_schedule_entries/browse

State Resources in regard to record retention schedule language and definitions: Government Records Preservation Act: http://www.kslegislature.org/li/b2013_14/statute/045_000_0000_chapter/045_004_0000_article/045_004_0002_section/045_004_0002_k/

State Records Management Manual: http://www.kshs.org/p/state-records-managementmanual/11365

Electronic Records Guidance: http://www.kshs.org/p/electronic-records/11334

Legal Hold Retention procedures will be suspended when a record is placed on legal hold. A legal hold requires preservation of appropriate records under special circumstances, such as litigation or government investigations.

Data Sharing

PSU may share certain data with government offices or agencies under the following circumstances:
· When required by local, state, or federal law, or regulation.
· In response to valid subpoenas, court orders, or other legal processes.
· To comply with audits, inspections, or investigations.
· When necessary to ensure compliance with legal, tax, or regulatory requirements.
· Any data shared will be disclosed in a lawful and secure manner, ensuring only the minimum required information is provided.

Data Disposal

Once data reaches the end of its retention period, it will be securely deleted, destroyed, or anonymized, depending on its format and classification.

Policy Review and Updates

This policy will be reviewed annually or as necessary to remain compliant with changing legal, regulatory, and business requirements.

Compliance and Enforcement

Failure to comply with this policy may result in disciplinary action, up to and including termination of employment or contracts. Violations may also be reported to relevant legal authorities if required.