P4.2

P4.2

The entity retains personal information consistent with the entity’s objectives related to privacy.

Category

Privacy

Subcategory

Privacy Criteria Related to Use, Retention, and Disposal

Points of Focus

Retains Personal Information [P][C]

Personal information is retained for no longer than necessary to fulfill the stated purposes, unless a law or regulation specifically requires otherwise.

Protects Personal Information [P][C]

Policies and procedures have been implemented to protect personal information from erasure or destruction during the specified retention period of the information.

Evidence Requests

Area of Focus	Artifact	Description
Asset Management	Data Retention Program	Documented evidence of a formal data retention program that governs the retention and destruction of data types.
Privacy	Authorized Use	Documented evidence of authorized use definitions for privacy-related data operations.