Skip to main content
Records Authority
Category: Disposition and Destruction

Unauthorized Disposition

Also known as: Unlawful or Accidental Removal, Defacing, Alteration, or Destruction of Records
Simply put

Unauthorized disposition refers to the unlawful or accidental removal, damage, alteration, or destruction of records that occurs outside of an approved process. In the U.S. federal context, agencies are typically required to notify the National Archives (specifically the Archivist) of any actual, impending, or threatened event of this kind. The concept can also arise in commercial contexts, where it may describe the theft, loss, or improper transfer of a controlled item outside of permitted terms.

Formal definition

Unauthorized disposition denotes any removal, defacing, alteration, corruption, deletion, loss, or destruction of records that is not carried out under an authorized disposition instruction or lawful process. It may be deliberate or accidental, and can encompass both improper destruction and improper removal or transfer of records from authorized control. In the U.S. federal recordkeeping regime, agencies are required to notify the Archivist of any actual, impending, or threatened unlawful removal, defacing, alteration, corruption, deletion, or destruction of records. Note that requirements, notification obligations, and definitions vary by jurisdiction and sector; the term also carries a distinct meaning in some commercial and channel-distribution contexts, where it refers to the theft, loss, sale, transfer, or distribution of a product other than as expressly permitted. This entry addresses the recordkeeping sense first; readers should not assume the federal notification framework applies universally.

Why it matters

Unauthorized disposition strikes at the core purpose of recordkeeping: preserving records as reliable evidence of activity across their lifecycle. When records are removed, altered, corrupted, or destroyed outside an approved disposition process, an organization loses not only the information itself but also the assurance that its records are authentic, complete, and trustworthy. This can undermine accountability, impair legal and audit defensibility, and, in the public sector, erode the historical and evidentiary record that citizens and oversight bodies rely upon.

In the U.S. federal context, the significance is heightened by a specific obligation: agencies are typically required to notify the Archivist of any actual, impending, or threatened unlawful removal, defacing, alteration, corruption, deletion, or destruction of records. This notification framework is designed to allow the National Archives to intervene, investigate, and where possible recover or prevent losses before they become irreversible. Reporting reflects the principle that authorized disposition must flow from approved instructions and lawful process, not from ad hoc, accidental, or improper action.

It is important to note that both deliberate and accidental events can constitute unauthorized disposition; the concept is not limited to intentional wrongdoing. Available guidance suggests that many such events arise from accident or error rather than malice, which underscores the value of preventive controls and staff awareness. Requirements, notification obligations, and definitions vary by jurisdiction and sector, so organizations outside the U.S. federal regime should identify the obligations that apply to their own context rather than assume the federal model applies universally.

Who it's relevant to

Records Managers
Records managers are typically responsible for ensuring that disposition occurs only under approved instructions and lawful process. They need to recognize when a removal, alteration, or destruction falls outside authorized channels and to understand the reporting or escalation obligations that apply within their jurisdiction and sector.
U.S. Federal Agency Personnel
Staff and officials in U.S. federal agencies operate under a specific obligation to notify the Archivist of any actual, impending, or threatened unlawful removal, defacing, alteration, corruption, deletion, or destruction of records. Awareness of this notification framework helps ensure that events are reported promptly so the National Archives can investigate or intervene.
Information Governance and Compliance Leads
Those responsible for the broader accountability framework benefit from understanding unauthorized disposition as a risk to be controlled through policy, training, and preventive safeguards. Because many such events may stem from accident or error, governance leads can focus on measures that reduce inadvertent loss as well as deliberate misconduct.
Archivists
Archivists are concerned with preserving records of enduring value and maintaining their authenticity and integrity. Unauthorized disposition threatens permanent and transfer-bound records alike, making the distinction between authorized disposition and improper action central to their custodial responsibilities.
Commercial and Channel Distribution Professionals
In some commercial and channel-distribution contexts, unauthorized disposition refers to the theft, loss, sale, transfer, or distribution of a product other than as expressly permitted by an authorization. Professionals in these settings should be aware that this usage is distinct from the recordkeeping sense and should not assume the federal notification framework applies to it.

Inside Unauthorized Disposition

Premature or unauthorized destruction
The destruction of records before their approved retention period has elapsed, or without the authorization required under an organization's disposition schedule and governance framework. This is often the most cited form of unauthorized disposition.
Disposition outside an approved schedule
Any disposition action, including transfer, destruction, or permanent preservation decisions, carried out without reference to, or in contravention of, an authorized retention and disposition schedule. Disposition is broader than destruction, so unauthorized disposition may also include improper transfers or misdirected preservation.
Breach of a legal hold or preservation obligation
Disposition of records that are subject to a legal hold, litigation, investigation, audit, or other preservation obligation. In many jurisdictions such disposition may carry heightened legal consequences, though the specific obligations depend on jurisdiction and sector.
Absence of proper authority or approval
Disposition undertaken by individuals lacking the delegated authority to approve it, or without the sign-off and documentation typically required by organizational policy. Authority for disposition is usually defined within an organization's recordkeeping governance.
Failure of accountability and documentation
Disposition carried out without an auditable record of what was disposed of, when, by whom, and under what authority. The lack of a defensible disposition trail is often what distinguishes unauthorized from authorized action, since authorized disposition is typically documented.
Loss of records as evidence
The consequence that authentic, reliable records evidencing organizational activity are no longer available, potentially undermining accountability, compliance, and the ability to demonstrate what occurred. This concerns records specifically, not merely transitory information or non-record copies.

Common questions

Answers to the questions practitioners most commonly ask about Unauthorized Disposition.

Is unauthorized disposition the same as accidental deletion?
Not necessarily. Unauthorized disposition refers to the destruction, transfer, or other removal of records outside the controls established by an approved retention and disposition schedule or applicable policy, regardless of intent. It can occur accidentally, through negligence, or deliberately. Accidental deletion is one way unauthorized disposition may happen, but the concept also covers deliberate and systematic removal, as well as transfers or migrations that bypass required authorizations. Framing the term solely around accidents understates its scope; the defining feature is the absence of proper authority for the disposition action rather than the presence or absence of intent.
Does unauthorized disposition only mean records were destroyed?
No. Disposition is broader than destruction. Disposition can include destruction, transfer to another body or custodian, or transfer to permanent preservation, and unauthorized disposition can affect any of these. A record moved or transferred without the required authority, or a record subject to a legal hold that is disposed of despite that hold, may constitute unauthorized disposition even where nothing was physically destroyed. Treating the term as a synonym for destruction alone overlooks unauthorized transfers, premature disposition, and other actions that fall outside sanctioned controls.
How can an organization detect that unauthorized disposition has occurred?
Detection often relies on the controls an organization already has in place rather than on the disposition event itself. Audit trails, system logs, and disposition documentation can help reconcile what should exist against what does exist, and gaps or unexplained absences may signal a problem. Periodic reviews against the retention schedule, reconciliation of destruction certificates or transfer records, and monitoring of high-risk repositories are commonly used. Depending on organizational policy and system capabilities, some unauthorized disposition may be difficult to detect after the fact, which is one reason preventive controls are typically emphasized alongside detective ones.
What controls help prevent unauthorized disposition?
Preventive measures typically combine policy, process, and system controls. These often include clearly approved retention and disposition schedules, defined authorization steps before any disposition action, access restrictions and permissions within recordkeeping systems, and mechanisms to suspend disposition when a legal hold or other freeze applies. Segregation of duties, documented sign-off, and staff training also contribute. The specific mix depends on jurisdiction, sector, and the organization's own governance framework, and no single control should be treated as sufficient on its own.
How does a legal hold interact with the risk of unauthorized disposition?
In many jurisdictions, a legal hold or litigation hold suspends normal disposition for records that may be relevant to actual or anticipated litigation, investigation, audit, or similar proceedings. Disposing of records covered by such a hold, even where the routine retention schedule would otherwise permit disposition, can constitute unauthorized disposition and may carry legal consequences. Effective practice generally involves promptly identifying affected records, applying and documenting the hold across relevant systems, and ensuring that automated or routine disposition processes are overridden for those records until the hold is lifted. The precise obligations and consequences vary by jurisdiction and sector.
What should an organization do after discovering that unauthorized disposition has taken place?
Responses depend on organizational policy and applicable legal and regulatory requirements, but common steps include documenting what occurred, identifying which records were affected and their significance, and assessing the potential legal, regulatory, operational, and reputational impact. Where records were subject to a legal hold or statutory retention requirement, escalation to legal, compliance, or governance functions is often warranted. Organizations frequently examine the underlying cause to correct control weaknesses and prevent recurrence. Whether notification or reporting to a regulator or oversight body is required depends on jurisdiction, sector, and the nature of the records involved.

Common misconceptions

Unauthorized disposition means only the illegal or malicious destruction of records.
Unauthorized disposition is frequently inadvertent, resulting from unclear schedules, lack of awareness, or process failures rather than intent. It also extends beyond destruction to include improper transfer or preservation decisions, since disposition encompasses more than destruction alone.
If a copy of the record still exists somewhere, its disposition was not really unauthorized or harmful.
The disposition of an authoritative record may still be unauthorized even where a copy survives, because a copy, draft, or transitory version may not carry the same authenticity, reliability, integrity, and usability that made the original a trustworthy record. Whether a surviving item is adequate depends on organizational policy and the properties of the record.
Destroying records at the end of a routine schedule can never be unauthorized.
Even scheduled destruction can become unauthorized if the records are subject to a legal hold or other preservation obligation, since such obligations typically suspend normal disposition. Whether and when this applies depends on jurisdiction, sector, and the specific obligation.

Best practices

Maintain current, approved retention and disposition schedules and require that all disposition actions reference an authorized schedule before they proceed.
Define and document who holds the delegated authority to approve disposition, and require appropriate sign-off before any records are destroyed, transferred, or otherwise disposed of.
Implement legal hold and preservation procedures that reliably suspend disposition for affected records, and confirm no applicable hold exists before executing disposition.
Keep an auditable disposition record capturing what was disposed of, when, by whom, and under what authority, so that authorized action can be demonstrated and unauthorized action detected.
Distinguish authoritative records from copies, drafts, and transitory information in classification and workflows, so that disposition decisions preserve the records that carry evidential value.
Provide ongoing training and clear guidance to staff to reduce inadvertent unauthorized disposition, and periodically review disposition practices against policy and applicable jurisdictional and sector requirements.