Define the release decision
A recommendation letter has moved through email, downloads, a scanner folder and an application portal. Duplicate copies increase exposure and can cause the wrong version to be submitted.
Remove abandoned drafts, download residue and unnecessary duplicates before archiving a recommendation letter.
Run the control sequence
- 01Confirm the final authorized version with the recommender or application workflow.
- 02Inventory downloads, email attachments, scan folders, cloud sync folders and removable media.
- 03Keep confidentiality boundaries intact; do not open or alter a letter the applicant may not inspect.
- 04Remove only copies you are authorized to delete and preserve any institutional or legal hold.
- 05Record cleanup completion without copying letter text into the log.
Preserve enough evidence
Record the dataset identifier, application cycle, source device or system, export date, manifest, responsible custodian, authorized recommenders, key location, encryption environment, recovery result, retention rule and next review date. Do not put passwords, recovery secrets or unnecessary applicant values in the decision record.
Keep the manifest, custodian, approved recipient, key-separation decision, restore result and retention owner together without copying applicant values into the record.
Keep surrounding controls visible
Copy cleanup cannot guarantee deletion from email servers, backups, SSD blocks, recipient systems or the recommender’s records.
Field conditions can create extra copies on tablets, laptops, removable media, synchronization folders and recipient devices. The archive owner must address those copies separately and verify the current software release before relying on product behavior.
Questions to ask
Should the access credential travel with the dataset?
Only when the approved research purpose requires linkage and the responsible owner has authorized the same recipient. Separation is a core risk control.
Does encryption make an export anonymous?
No. Encryption restricts file access; it does not remove identifiers or eliminate reidentification risk after decryption.
Primary references
References support specific controls and do not imply endorsement.