Click on a question below to view the answer.
You may also limit the results by entering a search term.

Cloud Storage

We store our records using a third party vendor. Are these considered a public record?

Yes. Using a third-party vendor to store information in the cloud or using third-party services, such as Moodle, as part of interaction with students does not affect how these records are defined. Even if the records are not in our custody, these records are created on behalf of the University. Therefore, they are public records and may be subject to requests and legal action.

How do we manage records held by a third party vendor or cloud service provider?

It is your responsibility to ensure vendors meet the retention requirements as well as delete the records after the retention has been met.  Further, the University must be able to access the records for the entire retention period, especially if they need to be turned over to the public records office, auditor or an attorney.

For more information about the responsibilities inherent in using a third-party cloud service provider, please refer to our resource on Cloud-Based Applications Best Practices.

What about the metadata around these records stored in the cloud? What is our responsibility?

Any metadata is considered to be part of the record and must be preserved and managed for the full retention period, the same as the content.

Our office is changing vendors. What should we do about the records at the vendor we are leaving?

You must retrieve and preserve any records which have not passed their retention until the full retention period has been met. While migrating these records to your new vendor’s platform is not absolutely required, the records must be retained in a form that remains accessible and readable. We recommend wording to this effect be included in your contract to help eliminate any misunderstandings on this point.

What does our office need to know before we start using OneDrive/Google Drive?

Any records created or received by your office must remain findable and accessible for the full retention period. This is not always straight forward in OneDrive/Google Drive. Keep in mind when using these systems:

  • Use a OneDrive for Business account linked to a departmental UW NetID. This allows you to sidestep the potential loss of documents that can occur when an employee leaves your department. Better yet, use a SharePoint site that has shared owner permissions.
  • You will not be able to use a Google Drive account liked to a Shared NetID and are at risk for the loss of active documents when the employee who created them leaves your department.
  • Like any other records repository, set and manage your access permissions in order for others to be able to view and access documents stored in the cloud. This prevents silos that can be lost or forgotten.
  • Incorporate records cleanup into your off-boarding process. Departing employees should delete any records that are past retention and, if using individual accounts, migrate any records with continuing retention to a durable, shared repository/location like SharePoint.

For more information about the responsibilities inherent in using a third-party cloud service provider, please refer to our resource on Cloud-Based Applications Best Practices. If you have questions, or would like further clarification, please contact us at recmgt@uw.edu or 543-0573.