Information deletion

What the requirement asks

Information held in systems, devices or any other storage media is to be deleted once it is no longer needed. Purpose: avoid sensitive information being exposed unnecessarily and meet legal, regulatory and contractual deletion requirements. Guidance: sensitive information should not be kept longer than necessary, to limit unwanted disclosure. When deleting from systems, applications and services, choose a method such as electronic overwriting or cryptographic erasure that fits business needs and the law, record the results as evidence, and obtain evidence of deletion from any deletion service provider. Where an outside party holds the organization's information for it, consider writing deletion requirements into the agreements for the period of service and its end. In line with the data retention policy and the law, delete sensitive information that is no longer needed by configuring systems to destroy it securely (for example after a retention period or on a subject access request); clearing out old versions, duplicates and temporary files in every location; using approved secure deletion software so that specialist recovery or forensic tools cannot retrieve it; using approved, certified disposal providers; and using mechanisms suited to the media, such as degaussing magnetic drives. For cloud services, check whether the provider's deletion method is acceptable and use it or ask the provider to delete, automating deletion under policy where possible, with logs to track or verify deletion depending on sensitivity. Remove hard drives and memory from equipment returned to vendors before it leaves the premises. Because some devices such as smartphones can only be securely wiped by destruction or built-in reset functions, choose the method according to the classification of what they hold, and apply 7.14 when destroying devices physically. A formal deletion record helps when investigating a possible leak. Other information: ISO/IEC 27017 addresses user data deletion in cloud services and ISO/IEC 27555 addresses PII deletion. In the ISMS the control is compared with the controls determined in risk treatment and recorded in the Statement of Applicability as included or excluded, with the reason and the implementation status.

What the guidance adds

Information deletion is a lifecycle control. The guidance asks for the trigger, the method, the verification and the record.

What good looks like

Put the control in the Statement of Applicability with an owner, a status and the risk it treats. Then keep the data retention topic-specific policy with deletion triggers per information type and one live sample together.

Evidence an assessor asks for

• Data deletionThe data retention topic-specific policy with deletion triggers per information type
• Data deletionConfiguration of automated deletion after retention periods or on data subject requests
• Data deletionDeletion logs or certificates as evidence, including from deletion service providers
• Data deletionApproved secure deletion tools and methods matched to media type (overwriting, cryptographic erasure, degaussing)
• Data deletionContract clauses requiring deletion by third parties and cloud providers during and at the end of service, and confirmation records
• Data deletionProcedure for removing storage and memory from equipment returned to vendors

The question an assessor will ask

An assessor will ask for the data retention topic-specific policy with deletion triggers per information type, then trace it to the system it protects. For A.8.10 the test is whether that record ties to a live sample, not whether the control is named in a policy.

Common gaps

• Information is deleted from the primary system but copies remain in backups, exports and temporary files
• No evidence of deletion is kept, so completion cannot be demonstrated
• Cloud providers' deletion methods are accepted without assessment
• Devices go back to vendors under warranty with drives still installed

Before the next audit

Before the next audit, check one live sample for this gap: information is deleted from the primary system but copies remain in backups, exports and temporary files.