Establishing secure connection…Loading editor…Preparing document…

Data Disposition Directive Form

This template is fully customizable. Edit the text, fill out the fields, and send it for signature. Give it a try!

DATA DISPOSITION DIRECTIVE FORM

This Data Disposition Directive (the Directive) is effective as of and is made by and between Requesting Party: with principal address and Data Custodian: with principal address .

RECITALS

WHEREAS, Requesting Party maintains an inventory of data and records containing personal, proprietary, or regulated information that require disposition in accordance with contractual, statutory, or internal retention obligations; and

WHEREAS, Data Custodian is the party responsible for storage, safeguarding, and disposition of such data and possesses the operational capability to carry out secure disposition methods; and

WHEREAS, the parties desire a formal directive establishing the scope, methods, schedule, certification, and legal allocation of responsibilities for disposition of the identified data sets;

NOW, THEREFORE, in consideration of the mutual covenants set forth herein, the parties agree as follows:

1. DEFINITIONS

For purposes of this Directive, the following terms have the meanings set forth below: "Data" means all electronic or physical records, files, backups, media, and derivatives that contain information listed in the Data Inventory. "Disposition" means the process by which Data is permanently deleted, destroyed, returned, or otherwise rendered unrecoverable in accordance with the methods set forth in this Directive.

2. SCOPE OF DIRECTIVE

This Directive applies to all Data identified in the Data Inventory below and to all systems, devices, media, and third-party repositories under the custody or control of Data Custodian that contain such Data. The parties expressly agree that any derivative copies, extracts, or backups that include identified Data are within scope.

3. DATA INVENTORY

The parties shall identify the specific Data to be disposed by completing the inventory below. The inventory must describe each data set, its storage location, and any retention constraints.

4. DISPOSITION SCHEDULE

Data Custodian shall complete disposition of the Data no later than after the Effective Date, subject to any legal holds or exceptions set forth in Section 6.

5. DISPOSITION METHODS

Data Custodian shall employ disposition methods appropriate to the format of the Data and in accordance with recognized industry and regulatory standards. The primary methods authorized under this Directive are indicated below. Where "Other" is selected, a detailed description is required.

6. LEGAL HOLDS AND EXCEPTIONS

Notwithstanding any disposition schedule, Data Custodian shall not dispose of Data subject to a legal hold, regulatory investigation, litigation, audit, or other binding preservation obligation. To assert a hold, Requesting Party or a legally authorized representative must provide written notice specifying the scope and duration. Holds shall suspend the disposition obligations for affected Data.

7. CERTIFICATION OF DISPOSITION

Upon completion of disposition, Data Custodian shall deliver to Requesting Party a written certification that includes: (a) identification of Data disposed; (b) the disposition method used; (c) the date of disposition; and (d) a statement that the method rendered the Data unrecoverable. Certification shall be delivered within calendar days of completion.

8. RECORDKEEPING AND CHAIN OF CUSTODY

Data Custodian shall maintain contemporaneous records of disposition activities sufficient to demonstrate compliance with this Directive, including chain-of-custody documentation, method logs, serial numbers or identifiers of destroyed media, and the identity of personnel performing the work. Such records shall be retained for a period of from the date of disposition unless otherwise agreed in writing.

9. INDEMNIFICATION AND LIMITATION OF LIABILITY

Each party shall indemnify and hold harmless the other party from and against claims arising from its negligent or willful breach of this Directive. Except for gross negligence or willful misconduct, neither party shall be liable to the other for incidental, consequential, or punitive damages arising from disposition activities.

10. NOTICES

All notices under this Directive shall be in writing and delivered to the contact information provided below. Notice shall be deemed given upon personal delivery, receipt of confirmed electronic transmission, or three days after deposit with a nationally recognized overnight courier.

11. AMENDMENT; WAIVER; COUNTERPARTS

This Directive may be amended only by a written instrument signed by both parties. No waiver of any provision shall be effective unless in writing and signed by the party waiving compliance. This Directive may be executed in counterparts, each of which shall be deemed an original and all of which together shall constitute one instrument.

12. GOVERNING LAW; ENTIRE AGREEMENT; SEVERABILITY

This Directive shall be governed by and construed in accordance with the laws of without regard to conflict of law principles. This Directive constitutes the entire agreement between the parties with respect to disposition of the identified Data and supersedes all prior agreements and understandings on that subject. If any provision of this Directive is held invalid or unenforceable, the remaining provisions shall remain in full force and effect.

EXECUTION

The parties, through their duly authorized representatives, have executed this Data Disposition Directive as of the Effective Date first written above.

Requesting Party:

By:

Date:

Data Custodian:

By:

Date:

Enter text✕
Prepare your document for signing right on this page
  • 01 Edit the text and complete the fields
  • 02 Click Sign Now and on the next screen add recipients and signature fields in SignNow
  • 03 Start your free trial to sign and send your doc
Sign Now

What the Data Disposition Directive Form Is and When It Applies

The Data Disposition Directive Form is an internal compliance document that instructs authorized staff to dispose of specific records or data sets according to an organization’s retention policy and applicable law. It identifies the records in scope, the approved method of destruction or anonymization, the effective disposal date, and required approvals so that disposal actions are auditable and defensible across regulatory, privacy, and litigation contexts.

Why a Formal Directive Matters for Compliance and Risk Control

A documented disposition directive reduces legal risk, demonstrates regulatory compliance, and preserves chain-of-custody evidence. It standardizes who can authorize destruction and how destruction is performed, which helps satisfy auditors and regulators.

Why a Formal Directive Matters for Compliance and Risk Control

Who Typically Prepares and Approves These Directives

Several organizational roles participate in disposition workflows to ensure legal, operational, and technical controls are met.

  • Records Managers and Archivists responsible for cataloging and executing retention schedules and supervised destruction procedures.
  • Privacy Officers and Legal Counsel who review statutory obligations and confirm legal holds or litigation holds are absent.
  • IT and Security Teams who verify secure deletion or cryptographic wiping and preserve audit logs and metadata.

Coordination among these groups ensures disposal is timely, auditable, and consistent with regulatory retention obligations.

Essential Parts of a Professional Disposition Directive

A complete directive combines identification, scope, method, timing, legal basis, and approvals so disposal can be executed with an audit trail.

Directive ID

Unique identifier and version to track each disposition action across systems and audit processes.

Scope

Clear inventory of records, systems, or datasets covered, including date ranges and record identifiers for unambiguous selection.

Disposition Method

Specific authorized method such as secure shredding, degaussing, cryptographic wipe, or irreversible anonymization with vendor details.

Effective Date

The exact date when disposal may commence and the deadline for completing the destruction process.

Legal Basis

Citation of retention rules, policy references, or regulatory grounds that permit or require disposition actions.

Approvals

Named approvers, signatures, and required attestations to confirm authorization and accountability for the action.

Core Fields the Form Must Capture

Record ID: Unique identifier(s) for items
Custodian: Responsible person or department
Record Type: Category such as email, invoice, PHI
Retention Date: Final retention cutoff date
Disposition Method: Approved destruction technique
Approver Signature: Authorized signer and date

Step-by-Step: Issuing and Executing a Disposition Directive

Follow a defined sequence from identification to execution and documentation to maintain control and traceability.

  • 01
    Identify Records: Compile targeted files and indexes for review.
  • 02
    Confirm Retention: Verify retention schedule and legal holds.
  • 03
    Obtain Approvals: Collect signatures from authorized approvers.
  • 04
    Execute & Log: Perform destruction and attach proof to the directive.

Configuring an Online Disposition Workflow

Set up fields, approvals, and notifications before routing the form to ensure consistent execution and electronic evidence capture.

Field Configuration
Record Selection Use SKU, folder path, or database query
Approval Flow Multi-step: Legal → Privacy → Records
Authentication Email + optional 2FA or KBA
Audit Capture Save timestamp, signer IP, and certificate

Digital Signing, Formats, and Integration Checklist

Confirm the platform supports the required file formats, audit logging, and integration points before eSubmission.

  • Formats: PDF, DOCX accepted
  • Integrations: Connect to Google Workspace, Box, NetSuite
  • Auth Methods: Email link, SMS code, or SSO

Ensure the chosen solution records a tamper-evident audit trail and stores signed copies in your records repository for the retention period.

Typical eSignature Pricing and Feature Comparison

Common pricing and capability differences among leading eSignature providers. signNow is listed first per vendor comparison conventions.

signNow DocuSign Adobe Sign PandaDoc HelloSign
Starting Price $8/user/mo $15/user/mo $14/user/mo $19/user/mo $15/user/mo
Free Trial 7-day trial Varies Varies Varies Varies
Bulk Send Yes Yes Yes Yes No
Audit Trail Yes Yes Yes Yes Yes
HIPAA Compliant Yes Yes Yes No No

Common Internal Timelines and External Deadlines

Establish internal deadlines for approval, execution, and recordkeeping to ensure timely disposal and audit readiness.

Request Acknowledgement:

Respond within 7 business days of directive issuance

Approval Window:

Approvals completed within 15 business days

Execution Deadline:

Destruction completed within 30–90 days per policy

Audit Upload:

Attach proof within 5 business days after destruction

Retention Proof:

Preserve disposal evidence for required statutory period

Key Milestones in the Disposition Lifecycle

Track milestones from directive issuance through disposal and evidence retention to maintain a defensible chain of custody.

01

Issue Directive

Authorization and directive distribution to custodians

02

Approval Received

Formal sign-off from legal and privacy

03

Destruction Performed

Execute approved method and record details

04

Evidence Archived

Store certificates and logs for retention period

Common Preparation and Execution Mistakes

  • Unclear scope that leads to accidental deletion of active records and loss of recoverable evidence.
  • Failing to check for legal holds or pending litigation before disposal, resulting in spoliation exposure.
  • Inadequate destruction proof such as missing vendor certificates or lacking cryptographic wipe logs.
  • Using ambiguous language for disposal methods, causing inconsistent implementation across sites or vendors.

Potential Penalties and Legal Risks of Improper Disposal

HIPAA Liability: Civil and criminal exposure for improper PHI disposal
State Privacy Fines: Fines under laws such as CCPA for inadequate protections
Spoliation Risk: Sanctions, evidentiary adverse inference in litigation
Regulatory Sanctions: Penalties from sector regulators for noncompliance
Contract Breach: Vendor or customer damages for unauthorized destruction
Reputational Harm: Loss of trust and business continuity issues

Supporting Documents to Attach to the Directive

Attach documentation that proves proper authorization, selection, execution, and disposal verification for audit and legal review.

Retention Schedule

The records retention policy or schedule that authorizes the disposal, including retention end dates and policy version.

Legal Hold Check

Evidence that no legal holds or litigation holds apply to the targeted records at time of destruction.

Destruction Certificate

Vendor or internal certificate documenting method, date, and scope of destruction with supporting logs.

Approval Log

Signed approvals and timestamps showing authorized personnel reviewed and approved the disposition.

Who Can Legally Authorize a Disposition

Records Manager

Records Managers normally issue and execute disposition directives after verifying retention status, resolving holds, and coordinating with IT for secure execution; they maintain the operational audit trail.

Chief Privacy Officer

Privacy Officers review legal and regulatory implications, confirm that no privacy obligations prevent disposal, and provide legal attestations when required.

Real-World Examples of Disposition Workflows

Two concise examples illustrate how organizations combine policies, approvals, and secure execution to complete disposition tasks.

Martin Properties

Martin Properties used a standardized directive to retire tenant files across multiple offices

  • central records team validated retention dates
  • the company retained certificates and reduced storage costs while preserving audit evidence.

Fertility Centers of Illinois

Fertility Centers documented PHI disposal steps in a formal directive

  • privacy officer required signed approval and BAA-covered vendor destruction
  • detailed logs supported HIPAA compliance and satisfied internal audit review.

How to Update or Amend a Previously Issued Directive

Use a controlled amendment process to preserve version history and avoid accidental data loss when changing disposal scope or dates.

01

Request Change:

Submit amendment request with reasons
02

Legal Review:

Counsel evaluates legal holds and obligations
03

Approval:

Obtain re-authorization from approvers
04

Versioning:

Assign a new directive version ID
05

Execute Update:

Adjust selection and log changes
06

Archive Prior:

Retain prior directive for audit

Frequently Asked Questions About the Data Disposition Directive Form

Answers to typical questions about validity, electronic signing, legal holds, and evidence retention for disposition directives.


Need help? Contact support

be ready to get more
Join over 28 million airSlate SignNow users
Sign Now
Company
Forms
Pricing
Resources
Knowledge base
Other Products
© 2026 airSlate Inc. All rights reserved.