A.1.4.9 Disposal
The organization must have documented policies, procedures or mechanisms for getting rid of personal data. It must pick disposal methods with regard to, among other things, what the data is and how much of it there is, any metadata linked to it, and the physical nature of the storage media, because methods vary in how they behave and what they leave behind, for example how finely the media ends up broken down or whether erased information can be recovered.
Source: ISO/IEC 27701:2025, A.1.4.9. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open ISO/IEC 27701:2025 in the compliance library.
These are the artefacts auditors commonly ask for on this requirement, our guidance rather than text from the standard. Your assessor decides what is sufficient in your context, and asks for samples across the period when a report covers one.
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
- Disposal records identifying what was disposed of, when, by whom and by what method · Data governance / DLP tooling
- Assurance evidence where disposal is performed by a third party · Vendor register / contract repository
governing documentDocuments that govern the control
- Disposal policy naming the technique used per media type and data category · Policy repository / GRC workspace
- Consideration of associated metadata in the disposal decision · Policy repository / GRC workspace
First move
Common gaps auditors find
- One disposal method assumed adequate across all media, ignoring how outcomes differ
- Metadata such as filenames, indexes and audit trails surviving disposal of the data itself
- Third party disposal accepted on a certificate that does not identify the items destroyed
- Cloud held data disposed of by deleting a pointer, with the underlying storage untouched
- Disposal policy written for physical media only while most data is electronic
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet