SOC2-C1-DATA-DISPOSAL
Data Retention and Secure Disposal Policy
What this control does
Policy defining retention periods for each data type and procedures for secure disposal of data at end-of-life.
Implementation guidance
Document retention schedules for each data category. Implement automated deletion for expired data (e.g., delete logs older than 12 months). For hardware disposal, use certified data destruction vendors and retain certificates. For customer data deletion requests, define and honor a response SLA (e.g., 30 days).
Requirements satisfied
Why it matters
Uncontrolled data retention increases the blast radius of breaches, elevates regulatory exposure (GDPR, CCPA), and consumes storage costs unnecessarily. Improper disposal methods can leave sensitive data recoverable on decommissioned hardware, allowing attackers or bad actors to extract credentials, PII, or trade secrets. Without a formal policy, teams make ad-hoc decisions, creating gaps where critical data lingers indefinitely.
Evidence to collect
- Data Classification and Retention Schedule document (e.g., spreadsheet or policy showing retention periods for logs, backups, customer data, audit trails by type)
- Automated deletion job configuration and logs (e.g., cron job, cloud lifecycle policy, retention settings in logging service showing deletions executed)
- Hardware destruction certificates from certified vendor (e.g., e-waste vendor report with serial numbers, destruction method, and date for disposed devices)
- Customer data deletion request process documentation with SLA definition and sample fulfillment records (e.g., ticket showing request received, 30-day target, and deletion completion with audit trail)
Testing procedure
Auditor reviews the retention schedule and verifies it covers all data categories (logs, backups, customer data, credentials, audit trails). Auditor inspects logs or job execution history from the past 90 days to confirm automated deletions ran on schedule and old data was actually removed. Auditor selects one disposed device and verifies destruction certificate is on file. Auditor pulls 3–5 recent customer deletion requests and verifies each was actioned within the SLA (e.g., 30 days) with deletion timestamps in the system.
Common gotchas
Teams often create a policy but fail to automate deletion, resulting in manual processes that are skipped under deadline pressure; use infrastructure-as-code (e.g., S3 lifecycle policies, database retention rules) to make it hands-off. A common mistake is excluding "non-production" data (test databases, dev logs, backups) from the schedule, leaving sensitive copies around much longer than production—ensure the same retention rules apply everywhere data is stored.