Skip to main content
Records Authority
Category: Records Storage and Media

Off-Site Storage

Also known as: Offsite Storage, Off-Site Records Storage, Offsite Data Storage
Simply put

Off-site storage is the practice of keeping an organization's records, data, or backups at a secure location away from its main premises. It is commonly used to protect documents and information and, in the case of data backups, to support recovery if the primary site is affected by a disruption. The stored materials may be physical records or digital data, depending on the arrangement.

Formal definition

Off-site storage refers to the maintenance of records or data backups at a secure facility geographically separate from the primary operational site. For physical records, it typically involves a dedicated storage provider or repository holding materials that need not be immediately accessible on-premises; for digital data, it commonly involves replication of backups to a remote server or facility as part of a broader disaster recovery or business continuity approach. Sources note that data backups are often located at some distance from the main facility to provide redundancy and protection against localized events. Off-site storage should be distinguished from disposition decisions and from archiving as a preservation function: it describes the location and custody arrangement for holdings rather than their retention status, records classification, or long-term preservation treatment, all of which depend on organizational policy and applicable jurisdictional requirements.

Why it matters

Off-site storage addresses a fundamental vulnerability in recordkeeping: the concentration of records and data at a single location. When physical records or digital backups reside only at an organization's primary premises, a localized event affecting that site can compromise the organization's ability to demonstrate its activities, meet obligations, or resume operations. By maintaining holdings at a geographically separate facility, off-site storage provides redundancy and reduces the risk that a single disruption will result in the loss of critical records or the information needed to recover from an interruption.

For digital data in particular, off-site storage is commonly treated as a component of disaster recovery and business continuity planning. Replicating backups to a remote server or facility means that, should the primary site become unavailable, a separate copy remains accessible to support restoration. Sources note that backups are often deliberately located at some distance from the main facility so that a localized event is less likely to affect both copies at once. This separation is the practical basis for the redundancy that off-site arrangements are intended to provide.

It is important to note that off-site storage concerns where holdings are kept and who has custody of them, not whether they should be kept at all or for how long. Placing records off-site does not by itself satisfy retention requirements, resolve classification, or constitute a preservation strategy. Retention periods, disposition decisions, and long-term preservation treatment depend on organizational policy and on requirements that vary by jurisdiction and sector. Off-site storage should therefore be understood as one operational control within a broader records and information governance framework rather than a substitute for it.

Who it's relevant to

Records Managers
Records managers use off-site storage to manage physical and digital holdings that need not remain on-premises, balancing accessibility against space, cost, and security. They should ensure that placing records off-site is coordinated with retention schedules and classification decisions, since the storage arrangement itself does not determine retention status or disposition.
Business Continuity and Disaster Recovery Teams
For teams responsible for continuity and recovery, off-site storage of data backups provides the redundancy needed to restore operations if the primary site is affected by a disruption. Maintaining backups at a separate location is commonly treated as part of a comprehensive disaster recovery plan.
Information Governance and Compliance Leads
Governance and compliance leads need to confirm that off-site custody arrangements are consistent with applicable retention, security, and privacy obligations, which typically depend on jurisdiction and sector. They should treat off-site storage as an operational control within a broader accountability framework rather than as a means of satisfying retention or preservation requirements on its own.
IT and Data Protection Staff
IT and data protection staff manage the technical replication of backups to remote servers or facilities and oversee the redundancy that off-site arrangements provide. They also weigh commercial models such as usage-based cloud storage against the organization's recovery and security requirements.

Inside Off-Site Storage

Off-Site Physical Repository
A facility located away from an organization's primary premises where physical records are housed, typically operated by a commercial storage provider or maintained as a secondary organizational site. Environmental controls, access restrictions, and fire suppression are often features, though specific provisions depend on the provider and the sensitivity of the holdings.
Records Tracking and Indexing
The systems and metadata used to locate, retrieve, and account for records held off-site, such as box-level or item-level barcoding, container inventories, and catalog references. Accurate indexing is central to preserving the usability of records once they are removed from immediate reach.
Retrieval and Return Processes
The agreed procedures by which records are recalled from off-site storage and, where applicable, returned. These arrangements affect how quickly records can be accessed and typically form part of a service agreement when a third-party provider is used.
Chain of Custody and Access Controls
Documentation and controls that record who handles records during transfer, storage, and retrieval. Maintaining an unbroken and evidenced chain of custody supports the authenticity and integrity of records that may later be relied upon as evidence of activity.
Service Agreements and Custodial Responsibilities
Where storage is outsourced, contractual terms typically define custodial duties, security expectations, retention handling, and destruction on instruction. The organization ordinarily remains accountable for its records even when day-to-day custody rests with a provider, though allocation of responsibility depends on the agreement and jurisdiction.
Environmental and Security Conditions
The physical conditions under which records are kept, which may include temperature and humidity management, protection from water and fire, and controls against unauthorized access or loss. Appropriate conditions help preserve the integrity and usability of records over their retention period.

Common questions

Answers to the questions practitioners most commonly ask about Off-Site Storage.

Does moving records to off-site storage mean they have been archived?
No. Off-site storage refers to the physical location where records are held away from the main operational premises, not to a change in their status or lifecycle stage. Archiving typically implies a decision about long-term or permanent retention, often for records identified as having enduring value. Records placed in off-site storage may still be active or semi-active, may be subject to ongoing retention periods, and may eventually be destroyed, transferred, or preserved depending on organizational policy and applicable schedules. Location and disposition status are distinct concerns, and treating off-site storage as equivalent to archiving can obscure the actual retention and disposition obligations attached to the records.
Once records are sent off-site, do they cease to be the organization's responsibility?
Not typically. Engaging a third-party storage provider generally transfers custody or physical handling, but accountability for the records commonly remains with the originating organization. Depending on jurisdiction and sector, obligations relating to retention, security, privacy, integrity, and appropriate disposition usually continue to rest with the organization as the responsible party. The provider's duties are ordinarily defined by contract, and the organization often retains responsibility for ensuring those arrangements are adequate. Off-site storage relocates records; it does not, in most cases, extinguish the governance obligations attached to them.
How can retrieval of records held off-site be managed to support operational and legal needs?
Retrieval arrangements are typically governed by service agreements with the storage provider and by internal procedures. Organizations often maintain an index or tracking system so that individual records or boxes can be located and requested, and they may negotiate agreed turnaround times for standard and urgent retrievals. Where records may be needed at short notice, for example to respond to a legal hold, litigation, or a freedom of information request in jurisdictions where such rights apply, retrieval timeframes and access controls warrant particular attention. The adequacy of retrieval provisions generally depends on the sensitivity, frequency of use, and legal exposure associated with the records.
What should be considered when selecting and contracting with an off-site storage provider?
Considerations often include the provider's physical and environmental controls, security measures, access management, insurance, and demonstrated ability to meet retrieval and reporting requirements. Contractual terms commonly address custody, confidentiality, permitted access, handling of retention and destruction instructions, and the return or disposition of records at the end of the engagement. Where records contain personal or otherwise regulated information, contractual and due-diligence requirements may be shaped by applicable privacy and sector obligations, which vary by jurisdiction. The appropriate level of scrutiny generally reflects the risk profile of the records concerned.
How is the integrity and authenticity of records maintained while in off-site storage?
Maintaining integrity and authenticity typically depends on controlled handling, reliable tracking of movements, and protection against unauthorized access, damage, or alteration. A documented chain of custody can help demonstrate that records have remained unaltered and accounted for while off-site, which may be relevant where their evidential value is later tested. Environmental conditions, storage media, and the physical format of the records can affect their continued usability over time. These measures support the properties that distinguish an authoritative record from a mere copy, though the specific controls required generally depend on the value and sensitivity of the holdings.
How should disposition of records be handled when they are held off-site?
Disposition decisions are ordinarily driven by the applicable retention schedule rather than by the storage location, and off-site storage does not by itself alter when or how records should be dealt with. When a retention period ends, the required disposition may involve secure destruction, transfer, or permanent preservation, depending on the records' classification and organizational policy. Where a provider carries out destruction on the organization's behalf, arrangements often include documented authorization and confirmation that destruction has occurred. Coordinating the storage index with the retention schedule helps ensure that records are not retained beyond, or disposed of before, their required period, and that any legal holds are respected where such requirements apply.

Common misconceptions

Off-site storage is the same as archiving records.
Off-site storage refers to where records are physically located, not to a disposition decision. Records held off-site may be active, semi-active, or awaiting destruction, and their presence in a remote facility does not by itself mean they have been appraised as having archival or permanent value. Archiving in the recordkeeping sense involves a disposition determination that is distinct from a storage arrangement.
Sending records off-site transfers accountability to the storage provider.
Custody and accountability are not the same thing. A provider may hold physical custody, but the originating organization typically remains accountable for its records, including compliance with retention and disposition obligations, unless an agreement and applicable law provide otherwise. Custodial responsibilities should be defined explicitly rather than assumed.
Off-site storage guarantees the security and preservation of records.
Storage away from primary premises does not automatically ensure authenticity, integrity, or usability. Those properties depend on adequate environmental controls, access management, accurate tracking, and a maintained chain of custody. Poorly indexed or inadequately protected off-site holdings can be difficult to retrieve or may be compromised, undermining their reliability as records.

Best practices

Maintain an accurate, up-to-date inventory or index of all records held off-site so that holdings remain locatable and their usability is preserved.
Define custodial responsibilities, security expectations, and retrieval and destruction procedures explicitly in any service agreement, recognizing that the organization typically retains accountability for its records.
Document and evidence chain of custody during transfer, storage, and retrieval to support the authenticity and integrity of records that may later serve as evidence.
Confirm that environmental and physical security conditions are appropriate to the sensitivity and retention requirements of the records being stored.
Ensure records placed off-site remain linked to their retention and disposition schedules, so that storage does not become a substitute for a proper disposition decision.
Periodically review and reconcile off-site holdings against inventory records and applicable retention obligations, which may vary by jurisdiction and sector.