Key takeaways
- Delete information when it is no longer needed.
- Keeping data longer than needed increases risk and may breach privacy law.
- Start here: set retention periods for each type of information.
Purpose
Delete information when it is no longer needed.
Requirement
Requirement summaryInformation stored in information systems, devices or in any other storage media shall be deleted when no longer required.
Why it matters
Keeping data longer than needed increases risk and may breach privacy law.
How to implement
- Set retention periods for each type of information.
- Delete data securely when retention ends.
- Ensure suppliers delete data on request or contract end.
- Record deletions where required.
What evidence you need to provide
Here is what you will typically need to provide for Annex A 8.10. It does not matter which system it lives in: a document, screenshot or export is fine.
Documents to have ready
- Your rules for deleting information when it is no longer needed.
- Your Statement of Applicability (SoA: the list of all 93 controls showing which you use and why) with A.8.10 marked as used or not used, a short reason, and its current status.
Records and examples to show
- Records showing data was deleted on schedule.
- Records of customer deletion requests being completed.
- Certificates or confirmation of deletion from suppliers where relevant.
Things you should be able to show or explain
- Be able to explain how deletion is carried out and checked.
How much to show: Three to five deletion events.
Common mistakes
- Data kept longer than allowed.
- Deletion never checked.
- Backups keep deleted data forever.
- No process for customer deletion requests.
- Tip: Automate deletion based on retention rules.
Policies & documents to have
- Data Management Policy
FAQ
Is A.8.10 mandatory?
Annex A controls are not automatically mandatory. You must consider every control and record in your Statement of Applicability whether it applies and why. In practice, most organisations include this one.
What will I need to show for A.8.10?
Be ready to explain how the control works in your organisation and to provide things like: Your rules for deleting information when it is no longer needed…