← GLBA · Safeguards Rule (16 CFR 314)
314.4(c)(6) — Secure disposal within two years and periodic review of retention
Requirement
Customer information is securely disposed of no later than two years after the last date it was used to provide a product or service to the customer, unless it is needed for business operations or other legitimate purposes, required by law, or targeted disposal is infeasible; the data retention policy is reviewed periodically to minimise unnecessary retention.
What the engine looks for
Every group below must be satisfied — by an affirmative statement, not a plan, a hedge or a denial — for the control to count as covered. A term ending in … matches any word it begins. Supporting terms do not change the verdict — they raise confidence and distinguish a policy that names a mechanism from one that gestures at a category.
Finding any of these outranks coverage — a policy that admits the gap is worse than silence.
Equivalent controls elsewhere
Matched on shared topics. Satisfying this control usually moves these too.
| Framework | Control | Title | Shared topics |
|---|---|---|---|
| GDPR | Art.5(1)(e) | Storage limitation | data-retention data-deletion |
| SOC 2 | CC6.5 | Disposal of physical and logical assets | media-disposal data-deletion |
| SOC 2 | C1.2 | Disposal of confidential information | data-deletion data-retention |
| SOC 2 | P4.1 | Use, retention and disposal of personal information (P4.1–P4.3) | data-retention data-deletion |
| ISO 27001 | A.7.14 | Secure disposal or re-use of equipment | media-disposal data-deletion |
| ISO 27001 | A.8.10 | Information deletion | data-deletion data-retention |
| PCI DSS 4.0.1 | 3.2 | Minimise storage of account data | data-retention data-deletion |
| COPPA | 312.10 | Written data retention policy for children's information | data-retention data-deletion |