Data Protection for Higher Education – Evaluating Retention Periods, RTOs and Acceptable Data Loss
Posted by Gary Parker on July 21, 2010

Gary Parker, Sr. Product Marketing Manager
Data protection is no easy feat in the world of higher education. Recognizing retention periods for varying sets of data, determining required recovery times for each set, and mitigating data loss can be daunting tasks. Not to mention, you are often protecting a wide array of data while supporting thousands of users that range from those who are just sending personal emails to those conducting the most delicate of research projects And, when something goes wrong, it’s likely you’ll be inundated with a flood of complaints.
But instead of focusing on a reactive situation, let’s turn our attention to the objective of complaint prevention.
The very simple steps of a thorough data protection strategy are so often overlooked. Where does an IT professional supporting a higher education institution really need to start? It’s more than just understanding your data sets. Your team should really put the following in writing for each set and adhere to it:
- Retention period
- Recovery time objectives
- Amount of acceptable data loss
Let’s take a quick look at retention periods for a typical academic computing environment. Thinking this through will help you get data to the correct, most cost-effective storage medium and determine your method for storing it on that medium. You will likely have at least some of the following data sets. As an example, I asked BakBone customer, Martin Frankhouse at University of Detroit Mercy, for an overview of his typical retention periods, knowing that these definitely vary from institution to institution.
- Student Activities – 90 days
- Student email – 90 days
- Course content – 3 years
- Catalogs – 10 years plus
- Grades – Decades
- Research Projects – Potentially decades
Recovery time objectives could actually run on the same scale as your retention periods. For example, student email may have a short retention period and likely have a short recovery time objective. It may not be important enough for long term storage, but you better be able to get it back up and running fast in the event of downtime.
On the other hand, you may need to archive grades for long periods of time and may also be able to tolerate longer recovery times should something happen to your database. All this being said, your recovery time objectives will necessitate different tools for different data sets; for example, NetVault: FASTRecover can bring up Exchange data in as few as 30 seconds while NetVault: Backup can manage the archiving of data to tape. And, regardless of your backup application, while tape is a relatively inexpensive storage medium, it certainly takes longer than recovering from an online disk solution.
Finally, let’s take a brief look at minimizing data loss. One area that can help you to sleep well at night is knowing you have high availability to critical data and applications in the event of a minor human error to a major campus disaster. As I said earlier, understanding acceptable data loss for each data set is an important step in creating your data protection strategy. This doesn’t necessarily mean that any data loss is acceptable. It’s up to the responsible parties at your institution to have a very solid understanding of what exactly is acceptable and to ensure that those accountable for mitigating the loss have policies and protection in place to meet your recovery point objectives (RPOs). For example, losing a certain amount of student email is unlikely to bring your institution to its knees; however, losing critical research data might put a critical grant in jeopardy.
So, what’s the real essence of top notch data protection for the higher education environment? Understanding that not all data can be treated the same and ensuring that your solutions can most cost-effectively achieve acceptable retention periods, absolutely meet required recovery times, and effectively restore data to specific points in time. And, let’s not forget one of our important objectives from earlier: accomplish complaint prevention!
