UCSF Box Deprovisioning Process

We send an email reminder to Box users and their supervisor to transfer ownership of their files before they separate from UCSF.

When someone separates from UCSF, we deactivate the person's Box account within 24 hours and only retain the Box account for 90 days.

• Once the Box account is deactivated, the separated user's supervisor will receive all of their content, along with an email notification letting them know.
• If we can't find a user's supervisor, the content will be transferred to a holding account, and emails will be sent to each collaborator asking them to request ownership of the content. The request for ownership will be on a first-come-first-serve basis.

After the 90-day data-retention period the separated user's Box account will be removed.

For best practice, supervisors should remind their staff to transfer ownership before separation. This prevents losing access to shared content immediately upon the user's separation.

UCSF Box Reprovisioning Process

If a separated user returns to UCSF within 90 days we automatically reactivate the user's Box account.

If a separated user returns to UCSF more than 90 days after separation, a new Box account is created on login. The data they owned before separation stays with their manager or users we transferred their content to, and can be shared back to them by the new owner.

Access Without Consent

Supervisors and managers receive access to all folders owned by their separated staff, whether or not they were shared. Anyone else who needs access to previously unshared folders should follow the Access Without Consent process.

Related resources

• Records and Information Management
• UCSF Implementation of the ECP - Access Without Consent
• Consent to Access Electronic Information (PDF)