Requirement
The entity securely disposes of personal information to meet the entity’s objectives related to privacy.
Points of Focus
Captures, Identifies, and Flags Requests for Deletion [P][C]
Requirement: Requests for deletion of personal information are captured and information related to the requests is identified and flagged for destruction to support the achievement of the entity’s objectives related to privacy.
Disposes of, Destroys, and Redacts Personal Information [P][C]
Requirement: Personal information no longer retained is anonymized, disposed of, or destroyed in a manner that prevents loss, theft, misuse, or unauthorized access.
Destroys Personal Information [P][C]
Requirement: Policies and procedures are implemented to erase or otherwise destroy personal information that has been identified for destruction.
Explanation
When personal information is no longer needed — or an individual asks for it to be deleted — the organization must destroy, erase, or anonymize it in a way that prevents loss, theft, or misuse. Auditors examine how deletion requests are captured and flagged, and evidence that disposal procedures are actually carried out.
