Records Retention and Disposal Standard

Organization: Igzibo Engineering Solutions, Inc.
Version: 1.0
Status: Living standard
Effective Date: September 16, 2026
Owner: Igzibo Engineering Solutions, Inc.
Review Cycle: At least annually and after material changes to applicable law, contractual obligations, business operations, information systems, or records requirements.

1. Purpose

This Records Retention and Disposal Standard establishes requirements for retaining, preserving, disposing of, and managing Igzibo records.

The objective is to retain records long enough to support legitimate business, legal, contractual, operational, security, and compliance needs without retaining information indefinitely when it is no longer required.

2. Scope

This standard applies to records created, received, maintained, or controlled by Igzibo, regardless of:

• Format.
• Storage location.
• Information system.
• Device.
• Business function.
• Whether the record is created electronically or on paper.
• Whether the record is maintained by Igzibo or an authorized service provider.

Client-owned records remain subject to applicable client instructions and contractual requirements.

Definitions

• Business Record: Information created, received, or maintained as evidence of an organizational activity, decision, transaction, obligation, or other business matter.
• Disposition: The authorized final action taken for a record, including destruction, deletion, return, transfer, or continued preservation.
• Legal Hold: A direction to preserve information because it may be relevant to litigation, investigation, dispute, audit, regulatory matter, or other legal obligation.
• Record: Recorded information that is created, received, maintained, or relied upon in connection with organizational activity.
• Retention Period: The period for which a record is required or authorized to be retained.
• Temporary Information: Information that does not need to be retained as a business record after its immediate purpose has been completed.
• Igzibo: Igzibo Engineering Solutions, Inc.

4. Core Principles

Igzibo will apply the following principles:

1. Records should be retained according to documented business, legal, contractual, operational, security, and compliance requirements.
2. Records should not be retained indefinitely without a legitimate reason.
3. Legal holds and mandatory preservation requirements take precedence over ordinary disposal.
4. Records should remain reasonably accessible and protected throughout their required retention period.
5. Disposal should be appropriate to the sensitivity and format of the information.
6. Client requirements must be followed when they impose different retention or disposal obligations.
7. Retention requirements should be considered when adopting systems and third-party services that store organizational records.

5. Record Categories

Igzibo may maintain records including:

• Corporate and governance records.
• Contracts and agreements.
• Financial and accounting records.
• Tax and payment records.
• Employment and contractor records.
• Recruiting and candidate records.
• Client and project records.
• Technical and engineering records.
• Intellectual property and work-product records.
• Security and access records.
• Privacy records and requests.
• Incident and investigation records.
• Vendor and third-party service records.
• Communications and business correspondence.
• Compliance and audit records.

Specific retention periods should be established according to the applicable record category and requirements.

6. Retention Requirements

Records must be retained when required by:

• Applicable law or regulation.
• Contract.
• Client requirement.
• Legal hold.
• Litigation or dispute.
• Investigation.
• Audit or compliance obligation.
• Tax or financial requirement.
• Legitimate business or operational need.
• Security or incident-response requirement.

When multiple requirements apply, the applicable requirement that requires the longer preservation period should generally control unless an authorized legal or contractual determination establishes otherwise.

7. Retention Schedule

Igzibo should maintain a documented retention schedule identifying, where practical:

• Record category.
• Responsible business owner.
• Retention period or retention trigger.
• Required storage location or system.
• Applicable legal or contractual basis.
• Disposition method.
• Special preservation requirements.

Retention periods should be reviewed when material legal, contractual, business, or technology changes occur.

8. Legal Holds and Preservation

When a legal hold or other preservation requirement applies:

• Relevant records must be preserved.
• Ordinary deletion or destruction must be suspended for affected records.
• Personnel must not knowingly alter, conceal, or destroy affected records.
• Relevant systems or service providers should be identified where necessary.
• The hold should remain effective until the responsible authority authorizes release.

A legal hold takes precedence over an ordinary retention or disposal schedule.

9. Storage and Protection

Records must be protected according to their sensitivity.

Where applicable:

• Access should follow least-privilege principles.
• Confidential and Restricted information must be handled according to the Data Classification and Handling Standard.
• Organizational records should be stored in approved locations.
• Records should not be moved to personal email, personal cloud storage, or other unapproved services.
• Important records should be protected against unauthorized alteration or deletion.
• Backup copies should be managed consistently with the Backup and Business Continuity Standard.

10. Electronic Records

Electronic records may exist in:

• Business applications.
• Cloud services.
• Email systems.
• File storage.
• Source repositories.
• Project-management systems.
• Databases.
• Security and logging systems.
• Approved collaboration platforms.
• Other authorized systems.

System owners should consider retention, export, deletion, and preservation capabilities when managing systems that contain material records.

11. Temporary Information

Temporary information that is not a business record may be deleted when it is no longer required for its immediate purpose, provided that:

• It is not subject to a legal hold.
• It is not needed for an investigation or dispute.
• It is not required by contract or law.
• Its deletion does not interfere with required recordkeeping.

Temporary status should not be used to avoid retaining information that is otherwise a required business record.

12. Disposal

When the applicable retention period has expired and no preservation requirement remains, records should be securely disposed of using a method appropriate to their sensitivity and format.

Disposal methods may include:

• Secure electronic deletion.
• Destruction of physical media.
• Secure document destruction.
• Return to the client or data owner.
• Deletion by an authorized service provider.
• Other controlled disposition methods.

Disposal should be documented when required by the retention schedule, contract, law, risk, or business process.

13. Third-Party Services

When a third-party service stores or processes Igzibo records, the service should support applicable retention, export, deletion, and preservation requirements.

Material third-party services must be governed according to the Technology and Third-Party Service Security Standard and, where applicable, the Technology and Third-Party Service Approval Procedure.

14. Client Records

Client records must be handled according to:

• Client contracts.
• Statements of Work.
• Client security requirements.
• Client retention or deletion instructions.
• Applicable law.
• The Data Classification and Handling Standard.
• The Client Data Processing Standard.

Igzibo must not retain or dispose of client-owned records contrary to applicable contractual or legal requirements.

15. Workforce and Recruiting Records

Employee, contractor, candidate, and recruiting records must be retained and disposed of according to the applicable retention requirements and the:

• Employee and Contractor Privacy Notice.
• Candidate and Applicant Privacy Notice.
• Recruiting and Candidate Management Policy.
• Employee and Contractor Offboarding Procedure.

16. Security, Incident, and Investigation Records

Security incidents, investigations, access records, and related evidence must be preserved when needed to support investigation, remediation, legal obligations, client requirements, or other legitimate purposes.

Relevant records must not be destroyed merely because an incident appears to have been resolved.

17. Roles and Responsibilities

Business and Record Owners

Record owners are responsible for:

• Identifying material records within their area.
• Applying applicable retention requirements.
• Protecting records during their retention period.
• Initiating appropriate disposition when retention requirements expire.
• Preserving records subject to applicable holds.

Personnel

Personnel must:

• Maintain required records in approved systems.
• Follow retention and disposal requirements.
• Avoid unauthorized deletion or destruction.
• Preserve information when directed or when a known preservation obligation applies.
• Report suspected records-management violations.

System and Service Owners

System and service owners should:

• Understand the records stored in their systems.
• Support appropriate retention and disposal controls.
• Protect records from unauthorized alteration or deletion.
• Coordinate preservation and disposition activities when required.

18. Exceptions

Exceptions require documented authorization and should identify:

• The affected record or record category.
• Business justification.
• Applicable requirement.
• Risk.
• Compensating controls where appropriate.
• Responsible owner.
• Review or expiration date.

Exceptions must not authorize conduct prohibited by law or binding contractual requirements.

19. Enforcement

Failure to comply with this standard may result in corrective action, access restrictions, contractual remedies, or other appropriate action.

20. Relationship to Other Governance Documents

This standard should be read together with applicable:

1. Privacy Notice.
2. Employee and Contractor Privacy Notice.
3. Candidate and Applicant Privacy Notice.
4. Data Classification and Handling Standard.
5. Client Data Processing Standard.
6. Technology Acceptable Use Policy.
7. Technology and Third-Party Service Security Standard.
8. Technology and Third-Party Service Approval Procedure.
9. Backup and Business Continuity Standard.
10. Security Incident Response Procedure.
11. Employee and Contractor Offboarding Procedure.
12. Recruiting and Candidate Management Policy.

21. References and Research Basis

This standard establishes Igzibo's organizational requirements for records retention and disposal. Specific retention periods should be established with consideration of applicable legal, regulatory, contractual, client, financial, tax, employment, privacy, and operational requirements.

Version History