P4.3 Personal information is securely disposed of
Securely disposes of personal information to meet the entity's objectives related to privacy.
5
artefacts
0
held by a system
4
at each review
hard
to go live
Vendor register / contract repository
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
- Disposal records for the period, showing what was disposed of, when, by what method and by whom · Data governance / DLP tooling
- Evidence of verification that the information is no longer recoverable, including certificates where a third party performed the destruction · Vendor register / contract repository
- Evidence disposal extends to physical records and media as well as electronic data · Physical access / facilities
- Evidence of the handling of data held by third parties on disposal, including confirmation of deletion · Vendor register / contract repository
governing documentDocuments that govern the control
- The disposal procedure for personal information, defining the method per medium and per system · Policy repository / GRC workspace
First move
This control is evidenced by people and documents, not systems. Put the document under version control with an owner and review date, and log each review as a record with reviewer and date. Do not try to automate it.
Common gaps auditors find
- Deletion recorded as a status flag with the underlying data retained and recoverable
- Third party deletion requested with no confirmation received or sought
- Physical records of personal information disposed of by ordinary waste rather than by secure destruction
- No verification step, so a failed disposal job is indistinguishable from a successful one
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetP4.2 Personal information is retained for only as long as needed · P5.1 Personal information is accessed only by authorized personnel