Electronic Data Removal Standard

Date: 10/9/2025                             
Last Revised: 8/14/2025                             
Governing Policy: IRM-003: Data Protection of University Information                          
Applies To: Academic Division, the Medical Center, the College at Wise, and University-Associated Organizations.  

 

Table of Contents

1. Purpose and Background 
2. Standards 
a) Destruction of University Records 
b) Removing Devices from Service
i) Storage of Electronic Devices or Media Awaiting Removal from Service 
ii) Transferring Research Data 
iii) Temporary Removal from Service 
iv) Permanent Removal from Service 
c) Secure Deletion of Highly Sensitive Data 
3. Definitions 
4. Related Links 
5. Further Guidance 
6. Exceptions

[Return to Library]

 

1. Purpose and Background

The purpose of this standard and its associated procedures and the IRM-003: Data Protection of University Information policy is to establish the requirements for the secure removal of University data from devices and storage media and the proper handling of devices and storage media that are temporarily or permanently leaving the custody their assigned users, with the objective of preventing unauthorized access, disclosure, or recovery of University data. 

 

2. Standards

 

a) Destruction of University Records

When destroying data that is a University Record that has met the required retention, please comply with the University Records and Information Management Policy by completing a Certificate of Records Destruction (RM3) form. Please visit the Records Retention Schedule to confirm the required retention or contact the Records and Information Management Office.

b) Removing Devices from Service

i)  Storage of Electronic Devices or Media Awaiting Removal from Service

When unattended by authorized personnel or unencrypted, any electronic device or media awaiting processing under these standards and the associated procedures must be stored within a locked cabinet, closet, safe, or drawer, and within in a controlled access building or locked office (building or office access must be badge or key-controlled and/or staffed by personnel who function in a security role). Storage of such electronic devices or media must be kept to a minimum, and keys or badges allowing access to them must never be accessible to unauthorized personnel.

ii)  Transferring Research Data

University-owned electronic devices or media storing research data may be transferred to another institution provided the requirements defined in the policy Ownership, Retention, Safeguarding, Management, and Transfer of Research Records (RES-002): 4. Transfer of Research Records (Original or Copies)) are followed.

iii)  Temporary Removal from Service

Procedures for handling electronic devices or media--whether being returned to a leasing company, transferred temporarily to the custody of persons unauthorized to access data stored on the device (e.g., for repair) or transferred within the University--are detailed in the Electronic Data Removal Procedures.

iv) Permanent Removal from Service

University-owned electronic devices and media that are being permanently removed from service must be surplussed promptly following removal from service and prior to permanently leaving the University. Procedures for University-owned devices and media to be surplussed vary by department and/or campus, as outlined below. Additional required procedures are detailed in the Electronic Data Removal Procedures.

Academic and Administrative Departments within Agency 207, University Foundations:

These areas must follow the procedure described in Facilities Management's Surplus Property Procedures for surplussing University-owned electronic devices and media. Items such as solid state drives (SSDs) that are being surplussed must be rendered unreadable by shredding or crushing so that the data-containing component is unreadable. Such items may not be re-used.

Agency 209 (Health System) Departments:

These departments must follow the procedures described within the Health Information and Technology Equipment Surplus Standard.

Departments at the University of Virginia’s College at Wise (Agency 246):

These departments must contact the Helpdesk at extension 4509 for the appropriate surplus procedure.

c) Secure Deletion of Highly Sensitive Data from devices remaining in service

Highly sensitive data stored on electronic devices or media must be deleted using secure methods once these data are longer required. The deletion must be performed using one of the methods described in the Secure Deletion section of the Electronic Data Removal Procedures.

[Table of Contents]

 

3. Definitions

See the list of definitions for the Acceptable Use, Data Protection, Information Security, and Privacy & Confidentiality policies.

[Table of Contents]

 

4. Related Links

[Table of Contents]

 

5. Further Guidance

[Table of Contents]

 

6. Exceptions

If you think you need to request an exception to these requirements, please refer to the Exceptions Process.

[Table of Contents]

Approved by, Date: Chief Information Officer, 08/14/2025       
Next Scheduled Review: 08/14/2028       
Revision History: 08/14/2025.