The Information Protection Life Cycle and Framework: Dispose

The Information Protection Life Cycle (IPLC) and Framework defines how information should be protected across three stages: acquire & assess, active use life (the “main sequence”), and disposition. Disposition is the concluding phase, where information is deleted, removed from computing systems, or archived when it has reached end-of-use-life. The rationale for disposition clusters into three drivers: information becoming invalid/irrelevant, organizational retention limits designed to reduce storage and legal liability, and regulatory compliance—especially privacy regimes such as GDPR and CCPA that force organizations to locate, classify, protect, export, and delete personal data, including honoring the “right to be forgotten.”

A central challenge is knowing where information resides across an extended enterprise. The same discovery, assessment, and classification capabilities used during acquisition can also support inventory and later disposition. Tools include classification products (first generation focused on types like classified, confidential, credit-card, healthcare; second generation emphasizing personal data for DPIAs), CASB for cloud-hosted data, DLP, and IAM access reconciliation to understand who can reach what.

Disposition requires choosing between deletion and archiving. Despite cheaper storage, deleting clearly unnecessary data remains compelling. Archiving is often required to meet retention mandates, but retained data does not need to remain inside active digital workspaces; removing old material from day-to-day environments reduces confusion and error while still meeting policy needs. Execution is complex because information is distributed across endpoints, servers, databases, file shares, collaboration platforms, CMS, and IaaS/PaaS/SaaS. No single solution can purge or archive everything, so organizations must combine multiple tools and run ongoing audits to identify items past active use and route them to deletion or archival pathways.

• The IPLC describes three stages in the life of information objects: acquire & assess, active use life, and disposition.
• Active use life is described as the “main sequence” of information.
• Disposition is the final phase where information is deleted or removed and archived from computing systems.
• Three major drivers for removing information are irrelevance/invalidity, security policies limiting retention, and regulatory compliance.
• GDPR includes a “right to be forgotten” that requires the ability to delete information upon request.
• Organizations commonly harmonize regulations either by applying the most restrictive rules universally or by using regional policies and localized storage.
• CASB, DLP, and information classification tools can be used to build an information inventory.
• First-generation classification tools scan for types such as national security classified, company confidential, credit card numbers, financial information, and healthcare records.
• Second-generation classification tools were developed to support DPIAs by finding personal data.
• No single solution can purge or archive all data objects of a given type across an extended enterprise.

• “Disposition may be the most forgotten or least considered of the phases in the IPLC…”
• “With GDPR, the prevailing attitude is ‘if we don’t need it get rid of it’.”
• “Moreover, GDPR allows data subjects the right ‘to be forgotten’.”
• “KuppingerCole believes that using information discovery tools is essential to adequately protecting it…”
• “Even though storage costs are a fraction of what they used to be, there is still a strong argument for actually deleting data.”
• “However, just because information may be required to be held for a certain period of time does not mean it has to be kept in your organization’s digital workspaces.”
• “Given the distributed nature of information… removing it can be a daunting task.”
• “No single solution will allow information owners to purge or archive all data objects… across an extended enterprise.”
• “Information disposition is an ongoing activity.”
• “Information audits can drive disposition processes, discovering information objects that are past their active use life and can be archived or deleted.”