DIA-5 - Data Retention Period and Right to Be Forgotten
Control for managing retention periods and deleting personal data
Control Definition
A data retention policy by category must be defined and applied, in line with the legal basis and applicable regulatory requirements, and information must be deleted automatically when its retention period expires, leaving evidence of the process. A formal process must be implemented to handle data subjects' rights —access, rectification, erasure, portability and objection—, verifying their identity, coordinating execution with systems and third parties, and responding within regulatory deadlines. The secure deletion of information from systems, backups and storage media must be ensured when it's no longer needed or before reuse.
Requirements
Requirement 1
We define and apply a documented data retention policy by category, based on the legal basis for processing and the applicable regulatory requirements.
Requirement 2
We implement a formal process to handle data subject rights requests: access, rectification, erasure, portability and objection.
Requirement 3
We verify the requester's identity, record the request and coordinate with systems and third parties to carry out the right exercised.
Requirement 4
We communicate the response to the data subject within the applicable regulatory deadlines.
Requirement 5
We implement mechanisms for the automatic deletion of data when its retention period expires, in primary systems and backups.
Requirement 6
We securely delete information stored in systems, devices and storage media when it's no longer needed.
Requirement 7
We keep deletion records as evidence of regulatory compliance.
Requirement 8
We review the retention policy annually and when regulations change.
Requirement 9
We verify deletion from primary systems, backups and third-party systems when the right to erasure is exercised.
Requirement 10
We keep a complete record of the rights requests handled.
Requirement 11
We verify that all storage media have securely erased or overwritten sensitive data and licensed software before disposing of them.
Requirement 12
We verify that all storage media have securely erased or overwritten sensitive data and licensed software before reusing them.