Requirement
The entity retains personal information consistent with the entity’s objectives related to privacy.
Points of Focus
Retains Personal Information [P][C]
Requirement: Personal information is retained for no longer than necessary to fulfill the stated purposes, unless a law or regulation specifically requires otherwise.
Protects Personal Information [P][C]
Requirement: Policies and procedures have been implemented to protect personal information from erasure or destruction during the specified retention period of the information.
Explanation
Personal information should be kept only as long as needed for its stated purpose, and while it is kept it must be protected from accidental erasure or destruction. Auditors review retention schedules, evidence that data past its retention period is removed, and safeguards that preserve data during the retention window.
