The Dangers of Forgotten Data

Data is easy to forget. Especially with the increase in legacy-to-digital transformation, it’s easy to overlook unused systems or historical backups. All too often, the focus is on transitioning to new, digital technologies without decommissioning the legacy systems they replace.

Over the past few years, several companies have fallen foul of such “forgotten data,” facing serious reputational damage and hefty regulator fines. In this article, we will explore the reasons why data is forgotten, how it can impact a company, and steps that can be taken to address the associated risks and dangers.

Why is Data Forgotten?

Forgotten data means data that is no longer being actively governed through its lifecycle from creation to defensible disposal. When this happens in an organisation, it runs the risk of breaching several regulations including the European Union’s General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA) and other global privacy regulations.

This can happen for numerous reasons, including:

What are the Unforeseen Dangers of Forgotten Data?

Data becomes forgotten because it is often not seen as a priority in terms of effort and budget within a company. But what are the impacts of a seemingly harmless oversight?

Steps to Prevent Forgotten Data

1. Communicate the importance of addressing legacy data risks

   Build a business case to gain executive buy-in to address forgotten data risks. Demonstrate the cost savings that can be made from defensibly disposing and archiving data from legacy systems and the risks that can be avoided in terms of cybercrime, reputational damage and ability to respond more efficiently and cost-effectively to compliance requests.

2. Govern data through its lifecycle

   Effective data governance should encompass the full range of policies, processes and controls that enable data to be governed from creation to disposal, including data management, data privacy, records management and information security. A fundamental data management principle is that data must always be owned throughout its life and appropriate processes put in place to ensure that data does not become orphaned or forgotten. Records management also has a key part to play ensuring a records retention schedule is defined and identifying the rules for defensible disposal or archiving of data. It is then possible to retire and decommission a legacy system and its data according to these rules. Does your company have the appropriate policies, standards and controls in place to ensure that all your data is governed effectively and compliantly?

3. Embed data governance into your SDLC processes

   Embed data governance principles into your System Development Lifecycle (SDLC) and most importantly ensure that end-of-life processes are considered and documented as part of the transition to service. It’s good practice to have an exit plan defined upfront that includes how the system will be decommissioned and the data managed securely and compliantly as part of that process.

4. Implement a standardised approach to application decommissioning

   Make sure you have a standard approach defined and communicated for application decommissioning that includes the remediation of the data they hold. This should include approaches and solutions to archiving data to alternate platforms if the data requires to be retained beyond the active life of the system for legal or regulatory reasons, as defined in the company’s records retention schedule.

5. Prioritise a data hygiene programme to address legacy data risks

   Undertake an audit of legacy systems and dark data such as historic file shares within your company. Ensure that you have up-to-date data privacy impact assessments (DPIAs) for your high-risk systems to understand the level of risk your company holds by retaining the legacy data indefinitely and what steps you can take to mitigate those risks. Record and track the risks within your company’s risk register and based on your company’s risk appetite create a prioritised and costed data hygiene programme to remediate data to address the identified risks.

6. Ensure data privacy is an integral part of your M&A due diligence

   Having a clearly defined set of data privacy roles, responsibilities and processes to support due diligence during M&A activities is critical in ensuring the dangers of forgotten data in the target company do not introduce unforeseen risk and vulnerabilities. Review any acquired systems and data flows and ensure data, privacy and security risks are documented. Develop and define a remediation plan to address these risks and proactively track them through to resolution.

7. Review your data backup policies

   To ensure backups don’t become forgotten data, have standardised backup processes and schedules including the frequency of backup, the retention period for each backup type, the security of backups and embedded controls to monitor and detect noncompliance. Have detailed processes to recycle (or securely destroy) backup tapes that have expired their retention period. Backup data is only intended for disaster recovery purposes and should not be used as a record archive from which data or records can be retrieved for other purposes by the business. By keeping it beyond its intended purpose you are introducing unnecessary data risk that could come back with a serious bite.

Download the PDF »

Related topics:

The views expressed herein are those of the author(s) and not necessarily the views of FTI Consulting, its management, its subsidiaries, its affiliates, or its other professionals.