A.2.4.3 Return, transfer or disposal of PII
The organization must be able to return, transfer or dispose of personal data securely and must share its policy on this with the customer. It must handle the capability securely whatever the outcome: handing the data back to the customer, passing it to another organization or controller, deleting, destroying, de-identifying or archiving it. It must give the customer the assurance it needs that data handled under the contract is wiped, by the organization and by its subcontractors, from every place it is held, backup and continuity copies included, once the customer's identified purposes no longer need it. The policy must state how long data is kept after the contract ends before disposal, so that the customer does not lose data because of an accidental lapse.
Source: ISO/IEC 27701:2025, A.2.4.3. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open ISO/IEC 27701:2025 in the compliance library.
These are the artefacts auditors commonly ask for on this requirement, our guidance rather than text from the standard. Your assessor decides what is sufficient in your context, and asks for samples across the period when a report covers one.
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
- Assurance evidence that erasure reaches backups, continuity copies and subcontractors · Backup / DR tooling
- Records of returns, transfers and disposals performed, per customer · Data governance / DLP tooling
governing documentDocuments that govern the control
- Documented return, transfer and disposal policy, made available to customers · Policy repository / GRC workspace
- Stated post termination retention period before disposal, with its rationale · HR system / LMS
- Contractual flow down obliging subcontractors to erase on the same terms · Policy repository / GRC workspace
First move
Common gaps auditors find
- Erasure certified for primary systems while backups retain the data for the full backup cycle, which the customer is not told
- Subcontractor copies unaddressed, so erasure assurance is given for data the organization does not control
- No post termination grace period, so an administrative lapse destroys the customer's data
- Grace period indefinite, so terminated customers' data is retained without basis
- Policy held internally and never made available to the customer
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet