P4.3
P4.3
The entity securely disposes of personal information to meet the entity’s objectives related to privacy.
Category
Privacy
Subcategory
Privacy Criteria Related to Use, Retention, and Disposal
Points of Focus
Captures, Identifies, and Flags Requests for Deletion [P][C]
Requests for deletion of personal information are captured, and information related to the requests is identified and flagged for destruction to support the achievement of the entity's objectives related to privacy.
Disposes of, Destroys, and Redacts Personal Information [P][C]
Personal information no longer retained is anonymized, disposed of, or destroyed in a manner that prevents loss, theft, misuse, or unauthorized access.
Destroys Personal Information [P][C]
Policies and procedures are implemented to erase or otherwise destroy personal information that has been identified for destruction.
Evidence Requests
| Area of Focus | Artifact | Description |
|---|---|---|
| Asset Management | Data Retention Program | Documented evidence of a formal data retention program that governs the retention and destruction of data types. |
| Privacy | Authorized Use | Documented evidence of authorized use definitions for privacy-related data operations. |