ATTICS International Document Retention and Secure Storage Policy

These policies are developed exclusively for ATTICS International. Any copying, sharing, or reuse without written consent is not permitted.

Purpose

ATTICS International is committed to maintaining accurate, reliable, and secure records to support service integrity, regulatory compliance, accreditation requirements, and stakeholder confidence.

The purpose of this policy is to define the principles and procedures for document creation, retention, storage, protection, retrieval, and disposal, ensuring confidentiality, integrity, availability, and traceability of all records.

Scope

This policy applies to:

It covers all document types including:

International Legal Considerations

Retention periods are established to comply with the most stringent requirements across all jurisdictions where ATTICS International operates, ensuring global compliance without reference to specific national legislation, with particular attention to GDPR requirements for personal data and ISO standards for technical records.

Policy Statement

ATTICS International shall:

Document Classification

Documents are classified as:

Confidential / Restricted

(e.g., examination papers, assessment results, client data, personnel records)

Controlled Internal Documents

(e.g., procedures, manuals, audit reports, internal communications)

Public Documents

(e.g., published policies, marketing materials, website content)

Retention Periods

Retention periods are defined based on legal and accreditation requirements. Typical minimum retention periods include:

(Exact retention durations are detailed in the ATTICS International Record Retention Schedule.)

Retention Schedule Maintenance

The ATTICS International Record Retention Schedule is reviewed annually and updated to reflect changes in international standards, accreditation requirements, and legal developments, with version control and change history maintained to demonstrate ongoing compliance.

Secure Storage Controls

Physical Records

Electronic Records

Cloud Storage Security Requirements

All cloud-based document storage solutions must provide end-to-end encryption, data residency controls allowing selection of geographical storage locations, audit trails of access and modifications, and certification against ISO 27001 or equivalent information security standards.

Access and Retrieval

Data Protection and Confidentiality

All document handling complies with:

Secure Disposal

At the end of retention periods:

Certificate of Destruction Process

For confidential documents, a Certificate of Destruction is issued following secure disposal, documenting the date, method, personnel involved, and specific records destroyed, with certificates retained for three years as evidence of compliance with data protection principles.

Backup and Disaster Recovery

ATTICS International maintains:

Recovery Time and Point Objectives

Document recovery objectives are defined as Recovery Time Objective (RTO) of 24 hours for critical records and Recovery Point Objective (RPO) of 24 hours, verified through annual disaster recovery testing with results documented in management review records.

Responsibilities

Top Management

Quality / Document Control Manager

All Personnel

Monitoring and Review

Document management processes are reviewed through:

Compliance with International Standards

This policy aligns with:

Related Documents

This policy should be read in conjunction with:

Distribution

This policy is distributed to all employees via the company intranet and is available to stakeholders upon request. All personnel are responsible for reviewing and complying with the latest version available in the document management system.