# Nonprofit Data Retention with Ian Gottesman

An episode of [Community IT Innovators Nonprofit Technology Topics](https://invisiblenetwork.ai/podcast/1536843269), 1 May 2026, 48 min.

Audio: https://www.buzzsprout.com/1029925/episodes/19092243-nonprofit-data-retention-with-ian-gottesman.mp3

Your nonprofit may be sitting on a data liability it doesn't know it has. Carolyn talks with Ian Gottesman, CEO of NGO ISAC, about data retention and why the question of what your organization keeps - and for how long - is more urgent than ever. Ian has been studying this topic for 30 years, and he makes the risks concrete: e-discovery requests, contractual disputes, subpoenas, and the exposure that comes from mixing personal and organizational data on staff devices. Most of the time, the threat isn't a headline-making congressional hearing - it's a vendor dispute or a board member's outside legal trouble that pulls your email and files into a lawsuit you didn't see coming. Ian walks through how to build a data retention policy, who in your organization needs to lead it, and why now. With AI tools beginning to ingest your file servers and inboxes, now is exactly the right moment to get serious about data hygiene. This episode covers: • The most common data retention risk for nonprofits isn't congressional testimony — it's a contractual dispute, a board member's outside legal matter, or a vendor conflict that pulls your organization into e-discovery. • Your backup retention schedule must align with your data retention policy. Backups that outlast your retention window are still discoverable — and that trunk of old backup tapes will find its way into a lawyer's hands. • Start your retention policy implementation with the most transitory data first: instant messaging and Slack, then email, then files. Automate deletion as much as possible, and make saving intentional and manual. • The hardest part of implementation isn't the policy, it's change management. People love their old emails. Enlist a senior leader (CEO, general counsel, COO) to champion the rollout, not just IT. • Clean data makes AI tools work better. If your file server is full of outdated drafts and duplicate documents, your AI tools are ingesting noise. A retention policy is the foundation of good data governance — and good AI outcomes. Resources Mentioned: • NGO ISAC • NTEN Course: Data Minimization and Retention — Ian Gottesman • Sample Not-for-Profit Document and Data Retention Policy — AICPA & CIMA • Document Retention Policies for Nonprofits — National Council of Nonprofits • Nonprofit Legal Defense Network (We the Action) Additional resource: Podcast: Prep Your File Permissions for AI Tools — Community IT Innovators _______________________________ Start a conversation :) • Register to attend a webinar in real time, and find all past transcripts at https://communityit.com/webinars/ • email Carolyn at cwoodard@communityit.com • on LinkedIn • on reddit/r/nonprofitITmanagement • on the Community IT website Thanks for listening.

## Transcript

[0:22] Carolyn Woodard: Welcome everyone to the Community IT Innovators Technology Topics podcast.
[0:26] Carolyn Woodard: I'm Carolyn Woodard, your host, and I'm here today with Ian Gottesman from NGO ISAC.
[0:32] Carolyn Woodard: So, Ian, would you like to introduce yourself?
[0:35] Ian Gottesman: Sure.
[0:35] Ian Gottesman: My name is Ian Gottesman.
[0:36] Ian Gottesman: I am the CEO of NGO ISAC.
[0:39] Ian Gottesman: Excited to be here on the Community IT podcast and excited to talk about record retention as something I've been working on for almost 30 years.
[0:46] Ian Gottesman: That's what I wrote my master's thesis on many, many moons ago at Florida State University.
[0:50] Ian Gottesman: And I'm happy to help people manage this risk and figure out a way to lower that risk and lower and increase the trust in the work you're doing, which is really the core of what the NGO ISAC does and what I hope you guys can do.
[1:04] Carolyn Woodard: Can you tell me a little bit more about NGO ISAC?
[1:06] Carolyn Woodard: That's a membership organization, right?
[1:08] Carolyn Woodard: People can join.
[1:09] Ian Gottesman: Yeah, so NGO ISAC, NGO stands for non-government organization or nonprofit organization.
[1:14] Ian Gottesman: Anyone uh that's US-based nonprofit can join.
[1:16] Ian Gottesman: Most of our 501c3s, but include C6s, C7s, and other sorts of nonprofits.
[1:20] Ian Gottesman: Uh, we're a community mutual aid organization.
[1:23] Ian Gottesman: We help um lower digital risk, improve cybersecurity, and increase trust.
[1:27] Ian Gottesman: So if you have a question about like, well, record retention, you can come there.
[1:32] Ian Gottesman: We have trainings on it, including the the one at NTEN that we'll talk a little bit about.
[1:35] Ian Gottesman: We have some internal ones too.
[1:37] Ian Gottesman: Um,
[1:37] Ian Gottesman: We have weekly webinars, we have an annual conference, we have a community with about a thousand individuals in it, representing about 500 company, 500 uh member nonprofits and about 75 um partner uh private companies, just helping uh figure out sort of complex issues and cybersecurity and making hard stuff easier.
[1:58] Carolyn Woodard: So if somebody is not a very technical person or is not the cybersecurity person at your organization, can they still join?
[2:08] Ian Gottesman: Yeah, 100%.
[2:08] Ian Gottesman: They can join if they're just trying to concern about risk and trying to figure out how cybersecurity works for their organization.
[2:13] Ian Gottesman: A lot of nonprofits are really, really small.
[2:15] Ian Gottesman: You have one person who's like doing all your operations and administrative stuff.
[2:19] Ian Gottesman: They're their HR person, the IT person, the finance person, the facilities person, the security person, et cetera, et cetera.
[2:27] Ian Gottesman: Um and their area of expertise may not be IT and cybersecurity, but yet they're in charge of it.
[2:31] Ian Gottesman: That that's a great person to join.
[2:33] Ian Gottesman: Or if you just have a curiosity in it, some organizations um have a research program or or or uh core program about cybersecurity.
[2:41] Ian Gottesman: Certainly that those people are happy to join.
[2:43] Ian Gottesman: There's peer organizations of ours.
[2:44] Ian Gottesman: And I used to work at think tanks where we had scholarship studied cybersecurity.
[2:48] Ian Gottesman: They they are members.
[2:49] Ian Gottesman: Um, we have access to
[2:51] Ian Gottesman: Through our partners, some of the big vendors that maybe you wouldn't be able to easily talk to, like senior staff at Microsoft and Google that can help you sort of unravel a complicated problem um and resolve something that maybe you'd spend a long time going through a help desk escalation to like figure out this weird issue.
[3:08] Ian Gottesman: You can maybe find the person that actually built that tool or can resolve that issue and those things.
[3:15] Ian Gottesman: Um so yeah,
[3:17] Ian Gottesman: If you want to join, we're happy to do it.
[3:19] Ian Gottesman: And and there's a lot of people that'll meet you where you are and help you reduce that risk.
[3:22] Ian Gottesman: And cybersecurity is not the hardest thing in the world, but it's not the easiest user.
[3:25] Ian Gottesman: That's not typically something people are specialized in.
[3:28] Ian Gottesman: And so our goal is to make that easier for people and not have to like, you know, uh suffer through a security incident to get better at cybersecurity.
[3:37] Carolyn Woodard: Well, I will definitely include the link to your website and how to join in the show notes.
[3:43] Carolyn Woodard: I saw that you have the NTEN course.
[3:48] Carolyn Woodard: Um so I wondered if you wanted to talk a little bit about that and about data retention in general.
[3:55] Ian Gottesman: Yeah, yeah.
[3:55] Ian Gottesman: I can talk a lot about it.
[3:57] Ian Gottesman: Um so this is actually what I read my master's thesis on almost 30 years ago.
[4:01] Carolyn Woodard: No way.
[4:03] Ian Gottesman: Yeah.
[4:03] Ian Gottesman: So um to kind of go back a long time to 30, literally 30 years ago, 1997, I think it was.
[4:11] Ian Gottesman: So I'm from Florida.
[4:12] Ian Gottesman: I went to school at Florida State.
[4:14] Ian Gottesman: Florida has very strong open record laws.
[4:17] Ian Gottesman: Um, basically anything that isn't specifically exempted from the government does.
[4:21] Ian Gottesman: Anything that isn't specifically exempted is open by what they call the sunshine laws.
[4:26] Ian Gottesman: Email is relatively new in the mid to late 90s.
[4:29] Ian Gottesman: Um, and the state has a lot of big contracts and a lot of complicated processes for the big contracts you have to follow.
[4:36] Ian Gottesman: So a common tactic is uh someone bids on a contract, one person wins it, and then the loser um tries to see if people didn't follow the complicated process.
[4:49] Ian Gottesman: So they'll make uh a sunshine request, which is exactly the same as four-year requests to government employees, like uh who are involved in the negotiations.
[4:58] Ian Gottesman: Um, so
[4:59] Ian Gottesman: That happened in 1995 or 96 before I was an intern, a little bit before I was an intern.
[5:04] Ian Gottesman: Um and email was new at the agency, the the Department of Motor uh Department of Highway Safety and Motor Vehicles, the one that does the highway contracting in Florida.
[5:13] Ian Gottesman: So it's a for to build a big road, the contract they were disputing.
[5:17] Ian Gottesman: Uh and they were using mainframe computers to do their email and everything else.
[5:21] Ian Gottesman: You had one mainframe computer that they did everything on, or almost everything on.
[5:24] Ian Gottesman: Because it was a long time ago.
[5:26] Ian Gottesman: That's why it worked.
[5:28] Ian Gottesman: And to pull the emails that were requested, they had to do it at night, they had to stop other jobs, they had to bring in extra people because it couldn't be done by like the night operators who are like a lot of times low-level employees, not particularly skilled at like their email system, for example.
[5:44] Ian Gottesman: So there's a there's a pretty high cost to to pull those records, and they pulled them, and then they tried to bill the uh vendor that was in the dispute for it.
[5:53] Ian Gottesman: And the vendor said, Well, no, we're not gonna pay that, because you have a rule, you have by law under open records, you have to provide these and you have to do it in a in a low-cost timely manner, and you didn't meet those requirements.
[6:06] Ian Gottesman: Uh
[6:06] Ian Gottesman: The judge agreed, and then every agency thereafter realized, oh, we now have a whole new category of records of electronic records we have to keep track of and provide when requested.
[6:17] Ian Gottesman: Um, and then
[6:18] Ian Gottesman: That's what I wrote my master's thesis on.
[6:20] Ian Gottesman: I happened to work at one of the agencies that was implementing that policy.
[6:23] Ian Gottesman: Then I met with like the records and archivists and talked about best practices and looked at what some agencies were doing and evaluated those different agencies against the archivists' best practices.
[6:35] Ian Gottesman: Um, and that's been kind of something that's that's sort of kept up with me over the last 30 years.
[6:40] Ian Gottesman: Uh,
[6:40] Ian Gottesman: It's different when governments and and nonprofits doing it in the sense that governments have to provide all the information and they can't delete things.
[6:49] Ian Gottesman: They're explicitly, they're not allowed to delete things or or hide or not provide things unless it's explicitly allowed by by default, everything is open in government.
[6:59] Ian Gottesman: Nonprofits, it's the opposite.
[7:01] Ian Gottesman: You have to store things, um, explicitly decide what you store, and then you and then you delete everything else if you have a record retention policy.
[7:08] Ian Gottesman: That's typically what it is.
[7:10] Ian Gottesman: The idea for nonprofits is just to reduce that risk.
[7:13] Ian Gottesman: Um, and there are a lot of risks with storing tons of information.
[7:16] Ian Gottesman: There's like sort of black swan risk that everyone is really scared of, like getting called in front of Congress or um uh someone breaking into your email and leaking embarrassing stuff.
[7:31] Carolyn Woodard: Sharing, yeah, yeah.
[7:33] Ian Gottesman: Yeah.
[7:33] Ian Gottesman: Um comp Kompromat is the term they use.
[7:36] Ian Gottesman: It's a Russian term.
[7:37] Ian Gottesman: They're like leak embarrassing stuff about your organization.
[7:40] Ian Gottesman: Like Sony is the best example of that.
[7:42] Ian Gottesman: Or like that was what about 10 or 12 years ago?
[7:44] Ian Gottesman: Where they had Sony, they leaked like racist things that people at Sony were saying, and then everyone got fired, or a lot of the leadership got fired at North Carolina.
[7:52] Carolyn Woodard: I remember that.
[7:53] Carolyn Woodard: And I remember there were, wasn't it at that time too?
[7:55] Carolyn Woodard: I don't remember if it was related to Sony, but there were some uh politicians that got their their emails were leaked.
[8:04] Ian Gottesman: Yeah, and so politician politicians at the federal, state, and local level, that all their stuff is open through at the federal level, it's FOIA in Florida where I'm from, it's just called the Sunshine Laws.
[8:13] Ian Gottesman: And um, so their email is all open.
[8:16] Ian Gottesman: So a lot of politicians won't, for example, use email um or take notes because their notes can be seized.
[8:23] Ian Gottesman: Um,
[8:23] Ian Gottesman: What is a lot more common than like congressional testimony or the hacking, what happens a lot in organizations is contractual disputes.
[8:30] Ian Gottesman: So, you know, you have a vendor that you're dealing with, things don't go well, or even like you're not even maybe maybe you're not even dealing with the vendor directly.
[8:39] Ian Gottesman: Things don't go well, you have a contractual dispute, and then any discovery is made.
[8:43] Ian Gottesman: So a lawyer will send a request and say, like, we want all this type of information in your organization, or all this person's information.
[8:51] Ian Gottesman: And you have to provide it typically, um, or provide a very good reason why you're not, uh, that a judge approves.
[8:59] Ian Gottesman: And then
[9:00] Ian Gottesman: If you don't provide it, you can be found in contempt of court and you know, go to jail in theory.
[9:06] Ian Gottesman: I I don't know if that happens too often, but it does happen occasionally.
[9:09] Ian Gottesman: So if you don't delete or limit that sort of exposure, and and sometimes you can't, um, it can be a real invasion of privacy.
[9:16] Ian Gottesman: And it gets worse in the more recent times, right?
[9:20] Ian Gottesman: Because we don't do a great job, particularly on our phone, separating personal from private information.
[9:25] Ian Gottesman: So, for example, if you're using your phone, has a mix of of work and personal stuff, and you're involved in a court case, like you just said, like embezzlement or um any number of things, then your phone can be seized and include as e-discovery, and they just pull everything off your phone.
[9:41] Ian Gottesman: They in essence take a backup, run everything off your phone, uh, look at it in an automated way, but still they're looking at it, um, to see for those keywords or those conversations.
[9:52] Ian Gottesman: And they may look at your text messages, your photos, if you maybe if you have an online like uh
[9:58] Carolyn Woodard: Slack or Teams
[9:59] Ian Gottesman: Slack, journal, if there's a journal you're keeping, anything like that, right?
[10:02] Ian Gottesman: So it can be a real um not only an invasion of privacy, which it obviously is, it can also just be really, really time consuming because you have to provide that information.
[10:11] Ian Gottesman: It can be um expensive too.
[10:13] Ian Gottesman: It's up to you as an organization.
[10:15] Ian Gottesman: Do you want to uh provide that information and just give it to them?
[10:21] Ian Gottesman: Like if they request, you know, every meeting you had with a certain person, do you just want to give them all your meeting notes and all your meeting invites and emails and be done with it?
[10:28] Ian Gottesman: Or do you want your lawyer to look at it?
[10:30] Ian Gottesman: And if you don't have an internal counsel, that can be really expensive because someone has to look through it.
[10:33] Ian Gottesman: And oftentimes, even your internal counsel may not have a great deal of expertise in any discovery, so you may have to have an external counsel to look at it and to sort through it because it this is a pretty it's a very common, but also kind of expertise.
[10:46] Ian Gottesman: So there's tools that they'll use to sort through things and look for specific keywords and look for specific things um on both sides.
[10:55] Ian Gottesman: And there's tools built into like your office suites, your Google and your and your uh um Office 365 to help you pull out the e-discovery requests because it's such a common occurrence at this point.
[11:05] Ian Gottesman: They they built management tools right into those tools, right into the suite of tools.
[11:10] Carolyn Woodard: I didn't know that.
[11:12] Ian Gottesman: Yeah, and so you will yeah, you'll go into like your Office 365 and like look at the e-discovery portal, enter the keywords, enter the people, enter the time frame, and then it'll spit out all the eligible information.
[11:24] Ian Gottesman: You'll provide that both the criteria you use to confirm that you're following the rules and the eligible information to a lawyer who then may provide it directly to the other lawyer, or you may provide to the other lawyer to look at.
[11:36] Ian Gottesman: Um, so that's time consuming.
[11:38] Ian Gottesman: And the more information you have, the more time someone has to go through it.
[11:42] Ian Gottesman: So, what uh
[11:43] Ian Gottesman: What you probably want to do to sort of reduce that risk is like come up with a policy and a process for what you're storing and why and how long and um who's doing it, who's responsible for it, and then uh make sure that you follow it.
[12:00] Ian Gottesman: And and then if you get any discovery requests, they're not looking at the whole, you know, 30 years of email or something.
[12:07] Ian Gottesman: They're just looking at the the last how many of your months you're you're stored by default.
[12:12] Ian Gottesman: Um and
[12:15] Ian Gottesman: That would be my recommendation is for people to really think about like what you're storing and why.
[12:20] Ian Gottesman: And most of the information you're storing is kind of core operational information, like fundraising, tax data, HR data, all of those things typically have legal requirements, like you know, your taxes are required to be stored for seven years.
[12:33] Ian Gottesman: Can they be audited for that long, for example, and fundraising is is similar.
[12:37] Ian Gottesman: Um,
[12:37] Ian Gottesman: So there's typically legal requirements that either your general counsel or your operations leads will know of why they want to store this money for how long.
[12:44] Ian Gottesman: And your like core program research as a nonprofit oftentimes doesn't have that requirement.
[12:50] Ian Gottesman: So you would that would fall under the default.
[12:53] Ian Gottesman: Um, and
[12:53] Ian Gottesman: The default can be anywhere from very short, like a few weeks.
[12:56] Ian Gottesman: I was talking to somebody actually at Community IT was saying they were how you guys are supporting an organization that uh basically their job is to sue other people.
[13:05] Ian Gottesman: That's what the kind of it's a nonprofit that does a lot of suits.
[13:08] Ian Gottesman: So by default, they don't want any information to be run because they get counter-sued.
[13:12] Carolyn Woodard: Right.
[13:12] Ian Gottesman: So they were he they were saying it was two weeks.
[13:14] Ian Gottesman: Um,
[13:15] Ian Gottesman: A lot of organizations will do six months, seven months, because uh that's just a period of time where 13 months is common um because it's longer than a year, and a lot of contraction things are a year, so keep it around for 13 months.
[13:26] Ian Gottesman: And then you you have a retention schedule that dictates how long you keep keep pieces of information beyond that and why, and who's responsible for it.
[13:33] Ian Gottesman: And sometimes it may even dictate what format it is.
[13:35] Ian Gottesman: Um
[13:37] Ian Gottesman: One other kind of risk that's very, very common that people don't think about is what I call tangential risk.
[13:42] Ian Gottesman: So a lot of nonprofits are have senior staff that are on boards of organizations or have board members that are senior at a private company or whatever.
[13:52] Ian Gottesman: Um, and then because of their relationship with these other organizations, not anything they actually do in their day-to-day work with you, then you're exposed to risk through them.
[14:01] Ian Gottesman: So if that organization is having a contractual dispute or your senior leader is on the board of an organization that's having a contractual dispute, um then that leader is getting their email e-discovered and you're having to provide it.
[14:16] Ian Gottesman: So there's a lot of different ways that the risk can happen and can create embarrassment.
[14:20] Ian Gottesman: Um, and by the time you had that happen, it's too late to do to like go in and delete things or come up with a retention policy.
[14:28] Ian Gottesman: Once there's a hold or any discovery request, you can't delete things at that point if the resolved to start that process.
[14:35] Ian Gottesman: Um so, yeah,
[14:37] Ian Gottesman: A lot of organizations have been spending time doing that over the last year or two, trying to figure out what their policies look like, why you do it, how you do it.
[14:47] Ian Gottesman: The vast majority of stuff we're doing in like email and Slack and almost everywhere else is like transitory.
[14:52] Ian Gottesman: It doesn't really, it's not super important to keep it.
[14:54] Ian Gottesman: It's not the final version, the final version of what's important.
[14:57] Ian Gottesman: And they're like transactional conversations, like where you're going to lunch.
[15:00] Ian Gottesman: Who cares once you've gone to lunch?
[15:02] Ian Gottesman: Do you really need to store that?
[15:04] Ian Gottesman: Um, and
[15:06] Ian Gottesman: The more instantaneous, the more transitory it is, and the less important you source, and also the steeper to more flippant things people will say.
[15:13] Ian Gottesman: So, like Slack, Teams, instant messaging.
[15:17] Ian Gottesman: That's where like people say really, really unfortunate things that you wouldn't want to expose in the public.
[15:22] Ian Gottesman: Um, so those are places, and also those are not places where you're gonna be like announcing your HR, your new HR policy, right?
[15:29] Ian Gottesman: You may you're not gonna store it there, you may announce it there.
[15:31] Ian Gottesman: You don't mind people to go to a meeting, for example.
[15:33] Ian Gottesman: Um
[15:35] Ian Gottesman: So that's where you can start, would be my suggestion.
[15:39] Ian Gottesman: Delete the, start your implementation of your retention policy with the things that are most transitory and the least likely to need to be saved.
[15:48] Ian Gottesman: And then come up with a policy where you have a what's called a general retention schedule where you have like what you're storing how long and who's who's responsible for it, what format it is maybe.
[15:56] Ian Gottesman: And
[15:57] Ian Gottesman: In some places, it may all maybe one person responsible on it.
[15:59] Ian Gottesman: Sometimes if you have a librarian or archivist, you just give it to them and then they're very good at it and store it for you.
[16:04] Ian Gottesman: In most cases, it's the subject matter expert, like your HR person's in charge of HR records.
[16:09] Ian Gottesman: Um and
[16:10] Ian Gottesman: You can start with those transitory messages like instant messaging like Slack or Team Signal, whatever.
[16:17] Ian Gottesman: Um, get those down very short, delete those very quickly.
[16:22] Ian Gottesman: Um, and then
[16:22] Ian Gottesman: Email is probably the next example of a transitory message where the vast majority of stuff can be deleted.
[16:27] Ian Gottesman: You need to have a process for people to say stuff.
[16:30] Ian Gottesman: So in email and Slack, maybe you can mark things and those don't get done, or maybe you print it out and stick it in a folder or
[16:37] Carolyn Woodard: That's gonna be one of my questions is can you do you recommend that like if you said that your policy was 13 months for email, would you automate that?
[16:47] Ian Gottesman: Automate it as much as possible.
[16:48] Ian Gottesman: So when something hits 13 months plus one day, it automatically deleted.
[16:53] Carolyn Woodard: Um can you do the same on like Slack and Teams instead of like you know disappearing messages?
[16:59] Ian Gottesman: You can do exactly.
[17:00] Ian Gottesman: Yeah, you can do that on Slack and Teams, and that's what you want to do.
[17:04] Ian Gottesman: You want to automate it so that as much as the deletion as possible is uh is automatic, and the saving is sort of ends up being manual because that also encourages people to not to only save things that are meaningful.
[17:14] Ian Gottesman: Um and
[17:15] Ian Gottesman: There's different ways you can have people save stuff, you can label it.
[17:19] Ian Gottesman: Um, and then once it gets a certain label, it it the label may be the actual retention period.
[17:23] Ian Gottesman: That's the most common way I've seen it done, but sometimes it's not.
[17:26] Ian Gottesman: So you label something.
[17:27] Ian Gottesman: Oh, this is seven years, so it's automatically stored for seven years if it's like a tax return, for example.
[17:32] Ian Gottesman: Um
[17:33] Ian Gottesman: And then the the thing that's probably the last that you'll go through and um end up is the most manual in my experience is your file shares.
[17:41] Carolyn Woodard: I was just gonna ask about that.
[17:43] Ian Gottesman: Yeah, those are typically um, those are typically like people have made a choice to save that stuff.
[17:50] Ian Gottesman: So it's saved on purpose, so there is has been some thought to go into it.
[17:54] Ian Gottesman: So you don't have as much like transitory stuff, as much junk for like a better way of describing it, old stuff that doesn't have a purpose.
[18:01] Ian Gottesman: There's still a lot there, probably four or five times is what is meaningful is is like not meaningful anymore.
[18:09] Ian Gottesman: What different versions, and like, oh, here's 12 different versions of this document as we edit it, it has to prove with different dates at the end or different initials or something.
[18:16] Ian Gottesman: Um but you have to have made a conscious decision to save that stuff.
[18:22] Ian Gottesman: Uh
[18:23] Ian Gottesman: Whereas, you know, email and messaging, it just sort of pours in and you can't really control what people send you.
[18:31] Ian Gottesman: Um and you and uh what again,
[18:34] Ian Gottesman: What should be determining how you save stuff is that that retention schedule that says this type of information should be stored for this long.
[18:40] Ian Gottesman: And it shouldn't matter if it's an email or a written letter, that's what determines the content of the message, and that's what's really important.
[18:47] Ian Gottesman: And then um you can decide how you want to store things.
[18:50] Ian Gottesman: Uh paper is really it may sound kind of silly at this day and age, but we've been storing paper since the beginning of history.
[18:57] Ian Gottesman: That's literally what defines history is writing and being able to look at stuff.
[19:01] Ian Gottesman: So if you want to if you want to save something, you can always print it out, stick it in a folder, and give it to your archivist, or keep it in your drive, your folder, file folders, and it'll be around for a long time.
[19:10] Ian Gottesman: Um,
[19:11] Ian Gottesman: That's a simple and easy way, and you just mark things with the folder like when you want to store it.
[19:15] Ian Gottesman: That's a lot a lot of times, like with HR, they'll do that, like have a folder that marks all the people that applied for a job in a given month.
[19:22] Ian Gottesman: And then once you hit the retention period for the end of that HR, like say 90 days is once a person's been hired, you then you would see like, oh, every every at the end of every month you go through a delete all back bookheads, you know, from that are more than 90 days old.
[19:35] Ian Gottesman: Um yeah, and you and
[19:38] Ian Gottesman: I mean because there are if you store things electronically, there are occasional disadvantages.
[19:42] Ian Gottesman: Like, I don't know how you would get something off like uh a floppy disk this in this day and age, right?
[19:47] Ian Gottesman: Or paper drive.
[19:49] Carolyn Woodard: Well, my my sister was telling me she has some of those old mini cassettes, you know, those dicta-phone type things that you would hold and take notes.
[19:58] Carolyn Woodard: And um, and she had one on a couple of vacations that she took like so many decades ago.
[20:04] Carolyn Woodard: And she kind of wants to get, you know, hear what she was saying, but there's yeah, it's very hard to get that.
[20:11] Ian Gottesman: Well no, right.
[20:12] Ian Gottesman: And so that's an that's the issue, right?
[20:14] Ian Gottesman: If you have a proprietary format or or a format that's electronic that's just hard to retrieve, it's what do you do to retrieve it?
[20:22] Ian Gottesman: Whereas if you print something out on paper, it's there and see it in perpetuity.
[20:27] Ian Gottesman: I mean, you can see things that ancient Romans and and ancient Greeks wrote and even further back.
[20:31] Carolyn Woodard: Although you you might want to put it in like a fireproof safe or something like that, if you're
[20:37] Ian Gottesman: Exactly.
[20:37] Ian Gottesman: And there are organizations and things you can pay that'll like take things off site, like HR records sometimes have to be stored for like the lifetime of the employees' um uh uh beneficiaries, which can be like their children or grandchildren, even.
[20:50] Ian Gottesman: Right.
[20:51] Ian Gottesman: So like the VA is still providing benefits to people that fought in World War I, for example, because the benefits go to their children and grandchildren, and they've had to store records that could be over 100 years old, which is very complicated to think about.
[21:03] Ian Gottesman: Um and I worked in a well, I didn't work, I lived in a place where a huge University and they provided benefits to people's children.
[21:11] Ian Gottesman: They ended up buying an old mall to store their HR records and other records for their archives and those going out of business.
[21:17] Carolyn Woodard: Wow.
[21:18] Carolyn Woodard: Wow.
[21:19] Carolyn Woodard: Um, I
[21:20] Carolyn Woodard: I guess I want to ask how does one get started if an organization does not have any kind of retention policy and there's this kind of new urgency around, you know, AI search and you know, maybe being worried about these risks that you talked about.
[21:37] Ian Gottesman: Yeah, so the easiest place to start is with that policy.
[21:39] Ian Gottesman: You can look at the NTEN course that I created.
[21:41] Ian Gottesman: We have stuff in NGO ISAC, it's a really popular topic.
[21:44] Ian Gottesman: We have stuff, sample policies.
[21:46] Ian Gottesman: Um, there are other organizations that have them, like the one of the sample policies I found when I was doing research on this was from the Association of Um Accountants, the um CPA Association.
[21:57] Ian Gottesman: I think it's AI CPA, if I remember correctly.
[21:59] Ian Gottesman: Um, so there's a lot of people that have this information out there and can be a model policy for you.
[22:05] Ian Gottesman: And then um, you want to find that people in your organization that are managing risk.
[22:08] Ian Gottesman: So a lot of times that's your general counsel if you have one, if not like your operations staff, like your COO, HR people, people like that.
[22:16] Ian Gottesman: You'll have a surprising amount of internal expertise in creating that.
[22:19] Ian Gottesman: Like your HR people will know how long they want to keep HR records because they're already doing it.
[22:23] Ian Gottesman: They just maybe have it written it down in a retention schedule.
[22:26] Ian Gottesman: Same thing with your finance team, your your and your development team, your fundraising team.
[22:31] Carolyn Woodard: Your board.
[22:33] Ian Gottesman: Yeah, your board.
[22:33] Ian Gottesman: Like all of these things exist in other places.
[22:35] Ian Gottesman: Um, maybe they're written down informal, maybe it's just on the on people's minds, like, oh, we keep our board notes for five years.
[22:42] Ian Gottesman: Um and
[22:44] Ian Gottesman: Then you just write those down in one place and you formalize it, and the policy end up kind of just looking like a table with a few different rows, like, oh, here's a row of the type of information, here's the row that says how long you're storing it for, here's a row that says who's responsible for storing it, and maybe here's a row that says what format we're storing it in.
[22:59] Ian Gottesman: And that honestly is not that's a hard part, but not the hardest part of the process.
[23:06] Ian Gottesman: The hardest part is um the change management.
[23:10] Ian Gottesman: People really love their data.
[23:12] Carolyn Woodard: That's what I was gonna ask is who do you uh do you so then you give that to your IT team?
[23:17] Carolyn Woodard: They're gonna automate as much as they can.
[23:19] Carolyn Woodard: But is it up to the IT team to tell all the staff this is how we do it, or does HR do that?
[23:24] Carolyn Woodard: Who messages it?
[23:26] Ian Gottesman: Um, the IT team would make it, would probably be the ones that enables it and tests it at works, right?
[23:31] Ian Gottesman: Like if you're deleting stuff on day 91, they would maybe set up a test and email box and make sure it deletes on day 91.
[23:38] Ian Gottesman: They're not gonna be the ones that are gonna have the like social capital or whatever you want to call it to do that typically.
[23:44] Ian Gottesman: You want a more senior person.
[23:46] Ian Gottesman: So the more senior person you can do, the better, like your CEO, your executive director, perfect.
[23:50] Ian Gottesman: COO, CFO, general counsel, someone like that, hopeful.
[23:53] Ian Gottesman: But the IT's role is really enabling the policy unless um like unless like enforcing it.
[24:00] Ian Gottesman: It's really it can be really unpopular.
[24:02] Ian Gottesman: People love email.
[24:03] Ian Gottesman: I cannot emphasize how much people love their old emails.
[24:06] Ian Gottesman: So uh you'll want to really communicate that and have someone in senior leadership help you communicate that.
[24:15] Ian Gottesman: You'll want them to like, you want to give people time to do it if they're gonna review all their emails or all their Slack messages or something.
[24:22] Carolyn Woodard: Yeah, don't tell them it's tomorrow.
[24:23] Ian Gottesman: Right, exactly.
[24:24] Ian Gottesman: Right.
[24:24] Ian Gottesman: It may be it maybe many months.
[24:26] Ian Gottesman: Like that's the hardest part is that sort of um change management.
[24:30] Carolyn Woodard: I feel like there's this conjunction of urgency.
[24:34] Carolyn Woodard: Like you said you wrote about this 30 years ago.
[24:38] Carolyn Woodard: And I feel like my entire time in nonprofits been it's been something that, like, oh, we should do that, oh, we need to do that.
[24:44] Carolyn Woodard: But it there's been no urgency around like, no, we actually have to do it.
[24:47] Carolyn Woodard: And now there's this convergence of those risks that you talked about.
[24:52] Carolyn Woodard: And also, I think AI coming in.
[24:55] Ian Gottesman: Yeah, AI and like using your data in ways you don't want, or like just
[24:59] Ian Gottesman: The other thing too is there's a cost.
[25:01] Ian Gottesman: Like when I started my career, there was a high cost of storing data, like just a little storage of data had a pretty significant cost, like, oh, it's you know, X hundred dollars per megabyte or gigabyte or whatever it was, terabyte per month.
[25:13] Ian Gottesman: Um, or just total, like a hard drive was expensive.
[25:17] Ian Gottesman: Yeah.
[25:17] Ian Gottesman: That's no longer the case.
[25:19] Ian Gottesman: So that what but
[25:20] Ian Gottesman: There is a cost in terms of like just like uh just the the mess, right?
[25:26] Ian Gottesman: The the the clutter of like if you have 30 years of emails, how do you find what's useful?
[25:31] Ian Gottesman: Um, and
[25:32] Ian Gottesman: Then also like one of the things I think that's helpful to me when I think about these things is like how what what's the analogy like in the real world?
[25:40] Ian Gottesman: So, for example, you go to your book, your mailbox, your physical mailbox, you take out your mail, you you know, open it up, see what's useful, what's not useful, you put in a recycle bin, what's what's something to do with, like a bill you pay, and then maybe you just put in the recycle bin in a month or two, or you apply to it.
[25:56] Ian Gottesman: Uh, you don't just open it up and shove it back in there for 30 years, right?
[26:00] Ian Gottesman: Forever.
[26:01] Ian Gottesman: And then you're like, oh, where's that bill from one month ago?
[26:05] Ian Gottesman: And you have to sort through 30 different years of emails to find the bill that your your cable bill or your phone bill or your whatever, your mortgage bill.
[26:12] Carolyn Woodard: Yeah.
[26:13] Ian Gottesman: So I think that that that people kind of think about that like, oh, that makes sense.
[26:17] Ian Gottesman: I don't need to store 30 years of emails.
[26:19] Carolyn Woodard: Yeah.
[26:19] Carolyn Woodard: We didn't, when we moved, we had had this big filing cabinet that had like, I can't even tell you, Ian, like all like old veterinarian records for like a cat that we didn't have anymore.
[26:35] Carolyn Woodard: I mean, just all the stuff that was just in this filing cabinet that it was just easy to leave it there.
[26:40] Carolyn Woodard: And when we moved, we were like, we literally don't need any of this stuff.
[26:45] Carolyn Woodard: And anything that was current or that we did need to save, we scanned and put it in, you know, a folder uh to keep that we can knew where to find it.
[26:54] Ian Gottesman: Right.
[26:54] Ian Gottesman: And that's kind of the same thing, right?
[26:55] Ian Gottesman: So you just you want to get rid of your electronic clutter, and this this process of record retention will stop the that clutter.
[27:02] Ian Gottesman: Um but kind of
[27:04] Ian Gottesman: Back to what we were talking about, the hardest part of this whole thing is the the change management and the rollout, particularly around email and files.
[27:11] Ian Gottesman: But
[27:11] Ian Gottesman: People feel less passionate about like their Slack messages, at least in my experience.
[27:16] Ian Gottesman: Um, but email people feel really passionate about.
[27:19] Ian Gottesman: They've created like ways to manage whole processes in email and like, oh, I use this, I flag this, and then I do that, and then I auto I have an auto reply that sends it to my boss.
[27:28] Carolyn Woodard: Yeah.
[27:29] Ian Gottesman: Um so to to do the change management, it's important to have like somebody who's very important helping you because the IT person's role is typically just enabling the process.
[27:42] Ian Gottesman: So general counsel is a real common one.
[27:44] Ian Gottesman: Um, even better, like a COO or an ED or a CEO.
[27:48] Carolyn Woodard: I like the idea of doing having the counsel do it because then you're like, oh, the lawyer's here.
[27:53] Ian Gottesman: Well, right, and they're gonna have to ...
[27:54] Ian Gottesman: And they're also obvious uh frequently they're the ones who are um approving the policy or even setting up the policy.
[28:02] Ian Gottesman: So
[28:03] Ian Gottesman: And your job as the IT person is to like enable it and make sure it actually works.
[28:06] Ian Gottesman: Like, oh, if you're gonna store things for seven years, make sure you have a place to store things for seven years.
[28:10] Ian Gottesman: So you don't just
[28:11] Carolyn Woodard: And that you're complying that you're destroying them after the seven years, yeah.
[28:15] Ian Gottesman: Exactly.
[28:15] Ian Gottesman: Um so it's important to do that change management piece to have important people involved.
[28:21] Ian Gottesman: Like in a perfect world, you have some sort of proof of concept or user group or whatever you want to call it that like tests this out.
[28:29] Ian Gottesman: So you're gonna store things for seven years and three months and six, six, five years, and whatever the different options are.
[28:35] Ian Gottesman: You can test it out with that group.
[28:37] Ian Gottesman: You write instructions, and that group can say, like, oh, these instructions are really good.
[28:41] Ian Gottesman: This video you created are real is really good, or this is terrible, redo it.
[28:45] Ian Gottesman: U
[28:47] Ian Gottesman: That group should include like a diverse set of people, like people who are in your up different operational parts of your organizations because they're the ones that are going to be in charge of saving some of stuff.
[28:55] Ian Gottesman: So it'd be good to have someone from HR, IT, finance, uh, development, fundraising.
[29:00] Ian Gottesman: Um, senior people having a really senior person in there is good, because then they can say, like, oh, I'm the chief muckety muck, and I've done this, it's totally possible.
[29:09] Ian Gottesman: And it sort of embarrasses like the mid-level mucky muck who says they can't do it.
[29:13] Ian Gottesman: Um,
[29:14] Ian Gottesman: And one another two groups of people are important are early adopters, like people that are like constantly trying to do the new new thing.
[29:20] Ian Gottesman: So the new new thing can be like your your record retention policy, or squeaky wheels, like the people that complain a lot.
[29:27] Ian Gottesman: Having them complaining early that you can deal with is much better than like you're rolling it out, and then this person's like, This doesn't work, it's terrible.
[29:35] Ian Gottesman: And you realize, oh, in addition to the person complaining, they're right.
[29:38] Ian Gottesman: Like, oh, they figured out something you didn't do right.
[29:40] Ian Gottesman: So it's much better to have them early in the process.
[29:42] Ian Gottesman: Um
[29:44] Ian Gottesman: And so you can do like that proof of concept group, and they can do it for like a month and make sure it works, and then you can roll it out to everybody else after that month.
[29:51] Ian Gottesman: People are gonna complain.
[29:53] Ian Gottesman: They love email.
[29:54] Ian Gottesman: It's it's hard to emphasize how much people love email, especially if they haven't been told to s to uh store it.
[30:00] Ian Gottesman: Um
[30:03] Ian Gottesman: And then you you know train people, remind them over and over again, uh, let them know it's gonna happen over and over again.
[30:12] Ian Gottesman: If they complain a lot, maybe you can extend the deadline of when you're gonna do it.
[30:16] Ian Gottesman: So instead of doing it on the first of the month, you do it on the 30th of the month.
[30:19] Ian Gottesman: Or extend the time frame of how long you're gonna do it for, like instead of doing it for six weeks or six months, you do it for 13 months.
[30:26] Ian Gottesman: Um and that'll make you more popular and the change a little more palatable.
[30:30] Ian Gottesman: Um
[30:31] Ian Gottesman: And then you can ratchet it down if you want, like in 13 months, you you you've retention period of 13 months, and you do that for a month, a few years or whatever, or a month or a few months or whatever.
[30:41] Ian Gottesman: You feel like, oh, we're we're storing a lot of data that we don't need that at that 13 months, you can go down to six months or six weeks.
[30:47] Carolyn Woodard: Yeah, yeah.
[30:48] Ian Gottesman: Your complaints.
[30:49] Ian Gottesman: Um that's really the hardest piece is the change management piece, just making sure people are aware of it and making sure and train your new people coming in.
[30:59] Carolyn Woodard: Like, I feel like that is often a good tactic, is if you have new people that you've just hired and you train them on this is how we do it, you know, and then eventually they'll use the number of old people you have still doing it.
[31:13] Ian Gottesman: Right.
[31:13] Ian Gottesman: And people are just kind of used to like, oh, we know we store our email for 13 months, and if I want to keep it for longer, I have to mark it, put it in a folder, or archive it somehow, print it out, whatever the whatever the methodology is, exported something.
[31:25] Carolyn Woodard: Yeah.
[31:25] Ian Gottesman: And depending on the process and the policy, you can make saving it harder to discourage any saving.
[31:31] Ian Gottesman: Like everything has to be printed out to save it.
[31:32] Ian Gottesman: So people are gonna have to print it out.
[31:34] Ian Gottesman: Do you really want it?
[31:35] Carolyn Woodard: Yeah,
[31:36] Ian Gottesman: or do you have to export it to this certain format and stick it in a in a document management system we have, or stick it in the shared drive folder that's labeled six months or whatever?
[31:45] Ian Gottesman: Um, because the then the folder will go through and delete things that are older than six months.
[31:49] Ian Gottesman: Um so yeah, you your policy and your process can sort of make storing as hard or as easy as you want.
[31:57] Ian Gottesman: Um
[31:59] Ian Gottesman: But your role as the IT leader is to just enable that process and hopefully it's not and and maybe have the tools that enforce it and make sure it works, but not be the one who's like ultimately responsible for the decisions.
[32:10] Ian Gottesman: That should be the people managing the risk.
[32:11] Ian Gottesman: So the general counsel is a really common one.
[32:13] Ian Gottesman: And if you don't have a counsel, it's like your operations lead.
[32:15] Ian Gottesman: And then you want an internal champion, uh, an executive sponsor.
[32:19] Ian Gottesman: Um the more senior the executive, the better.
[32:20] Ian Gottesman: I was at a place like this.
[32:21] Ian Gottesman: The CEO was on the on the um POC group.
[32:25] Ian Gottesman: And like I remember sending out an email and people complaining, and then he's like, Well, I did this.
[32:30] Ian Gottesman: How come you can't?
[32:31] Ian Gottesman: I'm talking to our funders, I'm talking to our board.
[32:33] Ian Gottesman: Those are the most important conversations we're having.
[32:35] Ian Gottesman: And I figured out ways to store those.
[32:37] Ian Gottesman: It's not that hard, I'm sure you can do it.
[32:38] Ian Gottesman: And then people are sort of flabbergasted, it's nothing.
[32:40] Ian Gottesman: Right?
[32:42] Ian Gottesman: They're like, Oh, you're you're talking to the most important people, maybe my email to my research assistant or my personal assistant.
[32:49] Ian Gottesman: So like so hard to manage.
[32:51] Ian Gottesman: Um that's still the key.
[32:54] Carolyn Woodard: Yeah, that's a great that's a great place to leave it, I think.
[32:56] Carolyn Woodard: If your CEO or executive director can do it, then everyone in your organization can do it.
[33:03] Ian Gottesman: And definitely like take like to your earlier point, like this has been a risk that people have been aware of but haven't given a lot of thought to.
[33:10] Ian Gottesman: Now people are giving it a lot of thought.
[33:12] Ian Gottesman: Take advantage of that.
[33:14] Ian Gottesman: Implement it now.
[33:15] Ian Gottesman: If you implement it a year from now, it probably might be harder.
[33:17] Ian Gottesman: If you implemented it a year ago, it wouldn't have certainly been harder.
[33:20] Carolyn Woodard: Yeah, kind of implement it before you get subpoenaed.
[33:23] Ian Gottesman: Well, yeah, if you implement it after you get subpoenaed, that's gonna, that's gonna get you in trouble.
[33:27] Carolyn Woodard: Yeah.
[33:28] Ian Gottesman: Right?
[33:28] Ian Gottesman: Especially if it's during the subpoena process.
[33:30] Carolyn Woodard: Right.
[33:31] Ian Gottesman: Um, if it's after the subpoena process is over, and then you're like, well, we've just been through this terrible thing, and you know it would have been easier if we had, yeah.
[33:39] Ian Gottesman: And people will agree, like, oh yeah, I don't want everyone going through every email that mentions you know this very common keyword, and I had to turn it over to this person.
[33:46] Ian Gottesman: It's really not my favorite, or had to give my phone to someone and sit there and watch as they, you know, for hours as they pull gigabits or terabits of data off my phone.
[33:56] Carolyn Woodard: Yeah.
[33:56] Ian Gottesman: Um, and you know, my phone has like my medical records and pictures of my family and all this other stuff that private and more private stuff can be on there that you don't want anyone to look at.
[34:07] Ian Gottesman: Um so yeah, you definitely want to get ahead of this stuff.
[34:12] Ian Gottesman: And you want to kind of, as an IT leader, you're gonna your job is gonna be to manage the process and less about the sort of um classifying the risk.
[34:21] Ian Gottesman: That should really be the people that understand the data or understand the risk.
[34:26] Ian Gottesman: And you kind of want to do it one system at a time, and broadly, like I kind of lumped it together in three three sets um chat or messaging, or whatever you want to call it, like team, Slack, instant messaging, Signal.
[34:37] Ian Gottesman: Um email. A nd then file storage.
[34:40] Ian Gottesman: And the most risk, risky ones are those chat frequent conversations, and then email is kind of in the middle and file at the at the bottom.
[34:48] Ian Gottesman: But what's determining how long you sort things is the type of message in your retention schedule, not what how it's being sent.
[34:55] Carolyn Woodard: Yeah.
[34:56] Carolyn Woodard: Um, it's probably a good time to remind everyone that they're using a organization-owned device that is not private to them.
[35:07] Carolyn Woodard: And that's not a lot of those like off-the-cuff comments and such I mean, it's not appropriate on a work.
[35:13] Ian Gottesman: Yeah, it's not appropriate in a work conversation.
[35:15] Ian Gottesman: And and it's hard, like in a in text, it's hard to know, like, oh, that sort of remark is funny.
[35:20] Ian Gottesman: It's not mean, or it's not in that's a joke.
[35:22] Ian Gottesman: That's a joke.
[35:23] Ian Gottesman: But it's hard to get tone or jokes.
[35:25] Ian Gottesman: So maybe the the joke isn't really meant to be put in writing.
[35:28] Carolyn Woodard: Yeah.
[35:28] Ian Gottesman: Um and you know, you want to think about uh the thing that the that they used to say a million years ago to me, which is still relevant, but maybe there's better analogies, is like, do you want that information on the front cover of the New York Times?
[35:41] Ian Gottesman: Yeah, right?
[35:42] Ian Gottesman: Or do you want it in the center of a social media storm?
[35:45] Ian Gottesman: Right?
[35:45] Ian Gottesman: Do you want, you know, they have Twitter to repost what you said, for example, I worked a places where that's happened.
[35:52] Carolyn Woodard: The couple that was on the jumbotron at the game.
[35:55] Ian Gottesman: Right.
[35:56] Ian Gottesman: And think about think about your email and these messages as not private, particularly if they're corporate, they're not private at all.
[36:03] Carolyn Woodard: Yeah.
[36:03] Ian Gottesman: So don't, ...
[36:04] Ian Gottesman: think about it.
[36:04] Ian Gottesman: Another analogy that people have made that is easy to understand is think about it as a postcard that anyone can see as it goes to the mail and not an something secured in an envelope like a letter.
[36:14] Carolyn Woodard: Yeah, that's a good way to think of it.
[36:16] Ian Gottesman: Right.
[36:16] Ian Gottesman: And and your organizational information, your organization has is bearing some of that risk.
[36:21] Ian Gottesman: So they have the ability to go in and look at it.
[36:23] Ian Gottesman: And some of them maybe are doing that.
[36:24] Ian Gottesman: I don't know.
[36:25] Ian Gottesman: And we're like looking for keywords and deleting things.
[36:28] Ian Gottesman: Most places I work, actually, I've never worked anywhere that does that.
[36:31] Ian Gottesman: I've heard stories of like, oh, this person worked at a very fancy finance firm, and then they said something mean in writing about the CEO, and then they got called in the HR office.
[36:37] Ian Gottesman: Not sure if those are true or not, but yeah.
[36:41] Carolyn Woodard: I find it hard to...
[36:42] Carolyn Woodard: I mean, so many of the nonprofits that we deal with, uh just having the time and personnel to be able to do something.
[36:49] Ian Gottesman: Yeah, right, exactly.
[36:50] Ian Gottesman: They don't have a time and personnel or interest to do that, but the tools are there to certain things.
[36:54] Ian Gottesman: So you want to think about that.
[36:55] Ian Gottesman: And that's the way e-discovery works is you go into like your Office 365 or your Google, entering the keywords, the time frame, the person, and it pulls out everything that's related to that, and then you give it to a lawyer.
[37:08] Ian Gottesman: And like in some cases, the lawyer will send you very precisely what you do, and even instructions like step by step, like the last, like what tools do you use for these things?
[37:16] Ian Gottesman: And you'll say, Well, I use I use Slack and I use uh Google and I use whatever.
[37:21] Ian Gottesman: And then they'll send you, like, okay, go to this setting, that setting, pull out this information, send it to me.
[37:27] Ian Gottesman: And then you're like, okay, and then you have you know, you can go through and see it.
[37:30] Ian Gottesman: And sometimes it's gigabits of information that you can't really sort that out manually.
[37:35] Ian Gottesman: There's other tools that will go through it.
[37:37] Ian Gottesman: Um, so it can be kind of overwhelming.
[37:41] Ian Gottesman: Uh,
[37:41] Ian Gottesman: And it's helpful to have a lawyer on your side.
[37:43] Ian Gottesman: There are like even if you're a nonprofit that doesn't have a legal counsel, either internal or external, there are places like We the Action and others that will get you pro bono or low bono home services, even specifically to e-discovery, because that's a kind of a specialized area of law.
[37:58] Ian Gottesman: But even if you have a general counsel, they may not know their area of expertise.
[38:04] Carolyn Woodard: Do you can people talk to their funder also?
[38:07] Carolyn Woodard: Because like often, you know, a bigger foundation will have experience with
[38:15] Ian Gottesman: They'll have experience or they'll have people to talk to.
[38:17] Ian Gottesman: Um, a lot of times it's around funding that these issues come, not so much like a grant per se, that's unusual, but a contract.
[38:25] Ian Gottesman: Like
[38:26] Ian Gottesman: I worked in an organization where we uh built a new headquarters, and there was a dispute between the general contractor and one of the subcontractors, and we were the we employed the general contractor.
[38:37] Ian Gottesman: Uh, and then there was e-discovery against all the people, myself included, that were involved in some of the meetings and contractual negotiations, and we had to provide it to that suit.
[38:48] Ian Gottesman: And you know, that's very common, that sort of risk that's maybe not directly what you're doing, but it's a contractual dispute between like different members of your organization or a subcontractor and a contractor you've engaged, or like board members on another board and they're in a contractual dispute, or you have a board member that's a senior leader of like a private company that's in a in a suit.
[39:08] Ian Gottesman: So there's a lot of different ways that you can get e-discovery.
[39:12] Carolyn Woodard: Yeah.
[39:12] Ian Gottesman: Most of them are not like congressional testimony, which is what strikes the fear in people because they've seen like, oh, here's the educational organization that got called for congressional testimony and they did e-discovery, and then the person was saying one thing publicly and then another thing privately.
[39:25] Carolyn Woodard: Yeah.
[39:26] Carolyn Woodard: Can I ask you one more thing?
[39:28] Carolyn Woodard: Uh, you said something earlier that I just wanted to maybe ask a little bit more about, and that kind of relates to, I guess, AI hygiene and data hygiene that I've been hearing more about.
[39:38] Carolyn Woodard: And
[39:39] Carolyn Woodard: You said, you know, often you'll have in those old, you know, SharePoint or Google Drive, you'll have five, six, a dozen, in my case, versions of the same document.
[39:50] Carolyn Woodard: And I've been reading and hearing that that can make it hard for AI to know which is the real one.
[39:57] Ian Gottesman: Yeah.
[39:57] Carolyn Woodard: But if you're going to search, you're using AI to search your documents, like pull up all of the program descriptions for you know, this year or this program area, it might be getting like those older versions that aren't what you want it to be looking at.
[40:13] Ian Gottesman: No, that's 100% true.
[40:14] Ian Gottesman: Like, so the AI kind of needs a sweet spot.
[40:17] Ian Gottesman: Like, because what it does in essence is like ingest a bunch of stuff and then repeats what it thinks is is meaningful or useful.
[40:23] Ian Gottesman: So if it's ingesting a bunch of garbage, it's gonna repeat garbage.
[40:27] Carolyn Woodard: Yeah.
[40:28] Ian Gottesman: So if you're gonna be using AI tools to like um, I don't know, help you write grants or help you write new policies.
[40:35] Carolyn Woodard: Or the annual report or yeah, exactly.
[40:38] Ian Gottesman: You want the the the best versions of those to be what it looks at.
[40:42] Ian Gottesman: So it's not looking at like drafts with like, you know, we've all seen files with like this person's initial because they reviewed it or this date or this time.
[40:49] Carolyn Woodard: Yeah,
[40:49] Ian Gottesman: You really want the final version or um to use it.
[40:52] Ian Gottesman: And that's why some AIs that use like better data are much better than like ones that are sort of ingesting like social media, where it's just like not very good because people just type and say silly things.
[41:04] Ian Gottesman: Um, so yeah, AI, it'll you know,
[41:09] Ian Gottesman: If you clean up your file servers and your email and you're gonna use AI or some tool to help you do better at automate your, I don't know, grant writing or your annual report or whatever, it's gonna get better results if you have better data.
[41:23] Ian Gottesman: Not not really enormously surprising.
[41:25] Ian Gottesman: And you need like governance data governance processes, which this this data retention is a part of.
[41:29] Ian Gottesman: Because the better data governance processes you have, the better data you have, and the better, easier it is to find the data, and easier it is to say, like, use this folder, um Chat GPT or Claude to uh collect all the information on our fundraising and then um let us know.
[41:47] Ian Gottesman: Let when I ask Claude to write a better fundraising proposal, it has the best fundraising proposals I've written and can pull that information out to help you.
[41:56] Carolyn Woodard: Yeah, yeah.
[41:57] Carolyn Woodard: No, I think that's kind of an added bonus of doing this data retention policy um um now.
[42:03] Carolyn Woodard: So
[42:04] Ian Gottesman: Yeah.
[42:04] Ian Gottesman: And if you have a lot, a lot of data, you can eventually hit that, like, oh, you have a terabyte per person or whatever the storage limit is for your office suite.
[42:12] Ian Gottesman: Yeah.
[42:13] Ian Gottesman: You can hit that um eventually, and then you start paying for it, and that can add up.
[42:20] Ian Gottesman: And so if you you just store a bunch of stuff, it does eventually hit that cost, it was much easier to do in the past.
[42:26] Ian Gottesman: Now you still there still is a cost eventually, like
[42:29] Carolyn Woodard: Do you ever have an organization that you've worked with or heard about that takes like um you know, a sledgehammer approach where you you're confident that like your HR team or the board have all of the documents that you have to retain.
[42:44] Carolyn Woodard: And you just say, you know, anything over seven years old, like it's just gone.
[42:48] Carolyn Woodard: Put it in an archive, and then after it's been in the archive for a year, then you delete it.
[42:53] Carolyn Woodard: You didn't retrieve anything, it's gone.
[42:55] Ian Gottesman: I did that at an organization I worked at during the pandemic.
[42:58] Ian Gottesman: We had an on-store's on-premise store file server, and then no one was working on-premise.
[43:02] Ian Gottesman: So getting to it was a really big pain in the butt.
[43:03] Ian Gottesman: You had to like VPN and VPN licenses, et cetera, et cetera.
[43:08] Ian Gottesman: So in that case, um, we just said anything over two years old for we like went group by group, file store by file store.
[43:16] Ian Gottesman: So, like if you're in this research program or this operational program, if you and it hadn't been accessed in over two years, we're gonna not upload it to the to the cloud storage to the SharePoint.
[43:27] Carolyn Woodard: Yeah.
[43:27] Ian Gottesman: If there's something specifically that you want uploaded that's over two years old, like this folder of really old reports that are important to you or photos, or yeah.
[43:35] Ian Gottesman: Yeah, just tell us we can do that.
[43:36] Ian Gottesman: Um, but we're gonna back everything up.
[43:38] Ian Gottesman: And if you find that something's not there, let us know.
[43:42] Ian Gottesman: And we did kind of exactly what you described.
[43:45] Ian Gottesman: There are a few exceptions.
[43:45] Ian Gottesman: HR said no, we want to keep everything, finance and development said similar stuff.
[43:49] Ian Gottesman: So we just uploaded everything for those guys.
[43:51] Ian Gottesman: Um but we backed everything up for I don't know, two or three years for a while.
[43:59] Ian Gottesman: Very rarely did people go back to it after the first five or ten days.
[44:03] Ian Gottesman: Like in five or ten days, they'd be like, oops, we should have saved this folder, and then we'd restore the folder and put it to the cloud.
[44:09] Ian Gottesman: Um and then we, you know, a year or two later we just threw out the the because we had backed it up to an external drive that was attached to our file server.
[44:18] Ian Gottesman: We threw out that drive and then um And then yeah, it wasn't the problem.
[44:27] Carolyn Woodard: I was just thinking that in for a lot of people, myself included, like it's just feels so overwhelming to think I I think I might have something in those files I want to keep, but I don't have time or energy to look through.
[44:40] Ian Gottesman: Yeah, and and you can do that's where the anxiety comes from.
[44:43] Ian Gottesman: Right.
[44:44] Ian Gottesman: You can do, like you said, the sledgehammer approach, or you can like have days like we're gonna do this over six months, and the first Friday of every month is gonna be a review day.
[44:53] Ian Gottesman: And you're gonna go through and look at your email or file storage and then delete all the stuff.
[44:58] Ian Gottesman: And then and then we have the stuff you want to keep somewhere, and everything else that's not in that keep folder is gonna be deleted or archived and whatever.
[45:06] Ian Gottesman: Um are definitely strategies to like alleviate that stress and and get people to look at files if you really want to, or you can do the reverse, like you're saying, just say, you know what, everything that's over seven years old that hasn't been accessed in five years or two years or whatever, we're gonna delete it unless you tell me otherwise.
[45:24] Ian Gottesman: And then um, and the vast majority of it is it's just junk.
[45:30] Ian Gottesman: You don't need it anymore.
[45:31] Ian Gottesman: You're just keeping it because there's no cost to you.
[45:33] Carolyn Woodard: Those people aren't even employed anymore.
[45:34] Carolyn Woodard: Right.
[45:35] Carolyn Woodard: I like the idea of like you move it to an archive for a year and anything that hasn't been accessed from the archive, like you clearly don't need it.
[45:43] Carolyn Woodard: Yeah.
[45:44] Ian Gottesman: One thing to think about when you're talking about backup is you want your backups to match your attention schedule.
[45:49] Ian Gottesman: So if your backup is if your attention schedule is 13 months, you don't want your backup to be in perpetuity, because then if you get a e-discovery request, you have to go to your backup and you're gonna go back and pull that stuff.
[45:58] Ian Gottesman: So when you're e doing e-discovery, you may need to re-um define your backups and say, like, okay, we're gonna redo it.
[46:05] Ian Gottesman: So we backup things for 13 months.
[46:07] Ian Gottesman: Um and you don't you don't keep things in perpetuity, and it may limit some of your backup choices.
[46:13] Ian Gottesman: Some backups now, because again, because this vault costs are just so low, and the backup tools get so good at compressing things and deduping and stuff that you're not, even though you may be producing tons of data on the backup, maybe so small that there's no very little cost.
[46:25] Carolyn Woodard: But that's a good point I hadn't thought about.
[46:27] Carolyn Woodard: They can they can still like subpoena your backup if it still exists there.
[46:31] Carolyn Woodard: So
[46:32] Ian Gottesman: Yeah.
[46:32] Ian Gottesman: One of the places I worked, we had this.
[46:34] Ian Gottesman: This is a long time ago.
[46:35] Ian Gottesman: We had to send like a uh like a trunk full of old backup tapes.
[46:39] Carolyn Woodard: Wow.
[46:40] Carolyn Woodard: And then you're kind of like, I hope your lawyers don't have fun.
[46:47] Ian Gottesman: Well, we're like, oh, those are encrypted and stuff.
[46:49] Ian Gottesman: You're like, don't worry, we can decrypt them.
[46:50] Ian Gottesman: And like, oh, that provides me a lot of confidence.
[46:52] Carolyn Woodard: Not yeah.
[46:55] Carolyn Woodard: Well, Ian, I want to thank you so much for your time today.
[46:58] Carolyn Woodard: This was just it was lovely as always talking with you.
[47:01] Carolyn Woodard: Thanks for making us smarter.
[47:02] Carolyn Woodard: I will share that uh link in the show notes to the course that you put together for NTEN um for for members of NTEN that can take to learn more about kind of more granular what they can do.
[47:15] Ian Gottesman: Yeah, and they can join our community.
[47:16] Ian Gottesman: All right, perfect.
[47:17] Ian Gottesman: Well, thank you and good luck with everything.
[47:19] Carolyn Woodard: Well, I just um thank you so much for doing this.
[47:21] Ian Gottesman: Happy to do it

Shows are listed from Apple Podcasts' charts and directory, and Podcast Index where it is used. Every show and episode belongs to its publisher and plays from the publisher's own feed; this site hosts none of them.