Two Meeting Recordings Swapped Retention Schedules After Release: Restore Both Disposal Clocks

A swapped retention schedule can create two different failures at once. One recording may have reached disposal too soon. The other may still be stored after its correct deadline.

Start by separating the records. Give each recording its own ID, assigned schedule ID, governing basis, accepted deadline, observed deadline, hold state and prior actions, reviewer, and approval evidence. That ledger becomes the working record for restoration and later review.

• Freeze nonessential retention changes that could affect either recording until the evidence review is complete.
• Preserve the incident record, including schedule changes, approvals, export and deletion activity, and recovery checks.
• Use the existing retention and legal-review process for decisions that require authority beyond the records owner.

Which evidence establishes the correct retention schedule for each recording?

Build the accepted deadline from the evidence that governs that recording, not from the schedule currently attached to it. Record the meeting and recording-creation dates, consent terms where applicable, contract or policy basis, and any approved exception.

For Google Meet recordings, Google Vault says Meet recordings are covered by Drive retention rules by default. When Meet-specific retention rules are turned on, Drive retention rules no longer apply to those recordings. The governing configuration must therefore be verified for the relevant environment before assigning a restored deadline. Google Workspace, October 13, 2026

For Microsoft 365, Microsoft says Teams meeting recordings and transcripts are included with files. A retention policy for files and recordings from user chats needs to include the organizer's OneDrive account as a location. Confirm the workload and storage location before treating a policy as the governing basis. Microsoft Learn

• Recording ID and current schedule ID.
• Meeting date and recording creation date.
• Consent, contract, policy, or legal basis that applies to this recording.
• Retention start event and accepted expiry date.
• Hold state and the hold's ID and owner.
• Approval evidence for the restored schedule and final decision.

Did either recording expire too early or remain too long?

Compare the accepted deadline with the observed deadline for each recording. A premature outcome means a deletion or other disposal action occurred before the accepted deadline. An overdue outcome means the recording remained available after the accepted deadline, subject to any hold or longer applicable rule.

Do not infer the record's state from what a user can see in an application. Microsoft warns that content visible in the Teams app does not accurately show whether content is retained or permanently deleted for compliance purposes. Use the applicable compliance and discovery tools to verify the state. Microsoft Learn

A hold changes the disposal decision. Google Vault states that holds take precedence over retention rules and preserve data until the hold is deleted. Microsoft also describes retention as preventing permanent deletion and keeping content available for eDiscovery. Google Workspace, October 13, 2026 Microsoft Learn

• Classify each record as premature action, overdue retention, no completed action, or state not yet verified.
• For a premature action, check authorized recovery paths and document the result without changing the original incident record.
• For overdue retention, verify that no hold, custom rule, record designation, or other longer applicable requirement blocks disposal.

How do you restore both clocks without losing the incident history?

Restore the schedule assignment or item-level rule only after the evidence and hold review is complete. Record the new effective configuration, who approved it, when it changed, and the resulting expected deadline. Keep the incorrect assignment and the remediation trail in the ledger.

Avoid broad edits that affect unrelated recordings. Microsoft distinguishes policies that assign the same settings at a site or mailbox level from retention labels that apply settings at the item level. The right mechanism depends on the scope of the correction. Microsoft Learn

A disposal decision needs evidence of authority and method. NIST describes media sanitization as making access to target data infeasible for a given level of effort, with techniques and controls selected for information sensitivity and disposal. Use the organization's approved disposal process and preserve its proof. NIST SP 800-88 Rev. 2, September 2025

• Keep all active holds in place until their authorized release.
• Restore the correct schedule or label only for the identified recording.
• Record the configuration change and the reviewer who checked the resulting deadline.
• For recoverable prematurely deleted content, document the recovery decision and any restored copy.
• For overdue content, dispose of it only after the reviewer confirms that the accepted deadline has passed and no hold blocks disposal.

Who should approve the recovery or disposal decision?

Assign one reviewer who can validate the governing basis and one authorized decision-maker for the recovery or disposal outcome. The same person may fill both roles only when the organization's process permits it.

NIST describes its security and privacy controls as flexible and customizable within an organization-wide risk-management process. Use the existing legal, privacy, records, and security approval route rather than creating an ad hoc exception for a schedule swap. NIST SP 800-53 Rev. 5, December 10, 2020

• Records owner: confirms the policy or schedule basis.
• Legal or investigation owner: confirms the hold state where applicable.
• System owner: applies the approved configuration change.
• Reviewer: checks the restored deadline and retained incident evidence.