Texas Administrative Code §202.78

This applies to all State of Texas Agencies and Institutions of Higher Learning

SECTION 202.78. Removal of Data from Data Processing Equipment

Here is the Texas Administrative Code regarding the sale or disposal of computers and their respective hard drives. These rules apply to all State Agencies and all Institutions of Higher Education. This information is provided as printed by the State of Texas. eRecycler knows the State of Texas Administrative Code and can help get your agency or college into compliance today.

Removal of Data from Data Processing Equipment

Texas Administrative Code (Last Updated: December 5, 2014)

PART 10. DEPARTMENT OF INFORMATION RESOURCES

CHAPTER 202. INFORMATION SECURITY STANDARDS

SUBCHAPTER C. SECURITY STANDARDS FOR INSTITUTIONS OF HIGHER EDUCATION

Latest version.

(a) Institutions of higher education shall comply with the requirements and procedures addressing the sale or transfer of data processing equipment in §403.278, Government Code (between institutions of higher education or state agencies) or Chapter 2175, Government Code (for all other transactions).

(b) Prior to the sale or transfer of data processing equipment institutions of higher education shall assess whether to remove data from any associated storage device.

(1) Electronic state records shall be destroyed in accordance with §441.185, Government Code. If the record retention period applicable for an electronic state record has not expired at the time the record is removed from data process equipment, the institution of higher education shall retain a hard copy or other electronic copy of the record for the required retention period.

(2) If it is possible that restricted personal information, confidential information, mission critical information, intellectual property, or licensed software is contained on the storage device, the storage device should be sanitized or the storage device should be removed and destroyed. Additional information on sanitization tools and methods of destruction (that comply with the Department of Defense 5220.22-M standard) are provided in the “Sale or Transfer of Computers and Software” guidelines available at .

(c) Institutions of higher education shall keep a record/form (electronic or hard copy) documenting the removal and completion of the process with the following information:

(2) description of the item(s) and serial number(s);

(4) the process and sanitization tools used to remove the data or method of destruction; and

(5) the name and address of the organization the equipment was transferred to.