How should we handle records stored in cloud apps like Google Drive, OneDrive, and Dropbox?

Content stored in cloud applications such as Google Drive, OneDrive, and Dropbox is subject to the same records management rules as anything kept on a local drive or in a filing cabinet. The storage location does not change whether something is a record. If a document, spreadsheet, message, or shared file is created or received in the course of business and documents an activity, decision, or obligation, it is a record and must be managed accordingly.

Apply the same principles, regardless of platform

A record’s value comes from its content and context, not where it lives. The same lifecycle obligations apply:

• Identification. Determine which cloud-stored content qualifies as a record versus convenience copies or transitory material.
• Classification and retention. Map records to your retention schedule and dispose of them only when authorized.
• Access and security. Control who can view, edit, and share files, especially when content includes personal, confidential, or otherwise sensitive information.
• Integrity and authenticity. Ensure records remain trustworthy, with metadata that captures who did what and when.

Address cloud-specific risks

Cloud platforms introduce challenges that need deliberate governance:

• Sprawl and shadow repositories. Easy sharing leads to duplicate copies and personal folders outside official control. Establish clear policies on where records of business value must reside.
• Version control and editing history. Collaborative editing can obscure the authoritative version. Define how a record is finalized and preserved.
• Custody and portability. You are entrusting records to a third party. Confirm you can export content, metadata, and audit logs, and that you retain the ability to migrate or dispose of records on your own schedule.
• Discovery and disclosure. Cloud-stored content is discoverable in litigation and responsive to public-records or freedom-of-information requests. It must be searchable and produceable.

Practical steps

Inventory the cloud apps in use, including informal adoption. Establish governance over each, integrate them into your retention and disposition program, and apply consistent access controls and audit logging. Train staff so they know which content is a record and where it belongs. Standards for managing records in digital environments offer a useful framework for these decisions.

For more on managing born-digital content across systems, see the electronic records topic hub.