Data Disposal
What is Data Disposal?
The secure destruction or deletion of personal data when it is no longer needed for its original purpose or when retention periods expire.
Frameworks that govern data disposal
What the standards actually require on data disposal
Requirements naming data disposal across 3 standards, quoted from the control text.
Make sure contracts with service providers carry security requirements, for example minimum requirements for the security programme, notification of and response to security incidents and/or data breaches, encryption of data, and commitments on data disposal.
CIS-15.4 · Ensure Service Provider Contracts Include Security Requirements →Make sure contracts with service providers carry security requirements, for example a minimum security programme, incident or breach notification and response, encryption and data disposal commitments, consistent with the provider management policy.
cis-controls-v8-1::15.4 · Ensure Service Provider Contracts Include Security Requirements →Consider the whole supply chain when setting cyber strategy and plans and build a framework covering business processes including third parties; build what is needed to manage third-party cyber risk across the lifecycle and set a third-party risk policy;
japan-fsa-cybersecurity-guidelines-for-financial-institutions::2.6-B · 2.6 Third-party risk management: basic actions →Questions people ask about data disposal
What is Data Disposal?
Why is Data Disposal important for compliance?
Which compliance frameworks address Data Disposal?
Where can I learn more about Data Disposal?
See how Data Disposal applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.