P4.2 Personal information is retained for only as long as needed
Retains personal information consistent with the entity's objectives related to privacy.
5
artefacts
3
held by a system
1
at each review
easy
to go live
Data governance / DLP tooling
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Evidence of enforcement, such as automated deletion jobs, purge reports or records of manual disposal · Data governance / DLP tooling
- Evidence retention covers all copies, including backups, archives, replicas, exports and third party held data · Backup / DR tooling
- Evidence of monitoring showing personal information beyond its retention period is identified and removed · SIEM / log platform
periodic reviewEvidence produced at each review
- Records of legal holds or other justified exceptions, with approval and expiry · Data governance / DLP tooling
governing documentDocuments that govern the control
- The retention schedule for personal information, with the period per data type and its legal or business basis · Policy repository / GRC workspace
First move
Automate the pull from your Data governance / DLP tooling. DLP policy hits, retention job logs and disposal certificates from the tooling.
Common gaps auditors find
- Retention schedule documented with no enforcement anywhere, so nothing is deleted
- Deletion performed in the production database while backups, data warehouses and exports retain the data
- Legal holds applied and never released, becoming permanent retention by default
- No monitoring, so overdue data is only discovered during an audit or an incident
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetP4.1 Personal information is used for purposes identified in privacy commitments · P4.3 Personal information is securely disposed of