7.4.6 Temporary files
The organization must ensure that temporary files created as a result of processing personal data are erased or destroyed under documented procedures within a specified documented period, performing periodic checks that
4
artefacts
2
held by a system
1
at each review
easy
to go live
Document repository
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Automated or scheduled cleanup with execution evidence · Document repository
- Inventory of temporary artefacts including rollback journals, caches, spool files and interim exports · Policy repository / GRC workspace
periodic reviewEvidence produced at each review
- Periodic verification that unused temporary files were in fact removed · Document repository
governing documentDocuments that govern the control
- Documented procedure naming the temporary file locations and the retention period for each · Policy repository / GRC workspace
First move
Automate the pull from your Document repository. Version-controlled document with owner, approval and review date as metadata.
Common gaps auditors find
- Temporary files unconsidered entirely, so the longest lived copy of personal data is one nobody knows about
- Procedure covering the application's own temporary directory while database, queue and export staging areas go unmanaged
- Cleanup scheduled and silently failing, with no verification to catch it
- Period specified for deletion but not the check that deletion occurred
- Interim files created by analytics and reporting excluded because they are not seen as processing
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet7.4.5 PII de-identification and deletion at the end of processing · 7.4.7 Retention