Requirement
Information stored in information systems, devices or in any other storage media shall be deleted when no longer required.
What the engine looks for
Every group below must be satisfied — by an affirmative statement, not a plan, a hedge or a denial — for the control to count as covered. A term ending in … matches any word it begins. Supporting terms do not change the verdict — they raise confidence and distinguish a policy that names a mechanism from one that gestures at a category.
Required element 1 — any one of
deletedeletionerasepurgeremove data
Required element 2 — any one of
retentionno longer requiredscheduleperiodretain
Supporting terms — specificity signals
lifecycle policyttlbackup expiryverifieddata subject request
Equivalent controls elsewhere
Matched on shared topics. Satisfying this control usually moves these too.
| Framework | Control | Title | Shared topics |
|---|---|---|---|
| GDPR | Art.5(1)(e) | Storage limitation | data-retention data-deletion |
| SOC 2 | C1.2 | Disposal of confidential information | data-deletion data-retention |
| SOC 2 | P4.1 | Use, retention and disposal of personal information (P4.1–P4.3) | data-retention data-deletion |
| PCI DSS 4.0.1 | 3.2 | Minimise storage of account data | data-retention data-deletion |
| GLBA | 314.4(c)(6) | Secure disposal within two years and periodic review of retention | data-deletion data-retention |
| COPPA | 312.10 | Written data retention policy for children's information | data-retention data-deletion |
| GDPR | Art.17 | Right to erasure (“right to be forgotten”) | data-deletion |
| CCPA/CPRA | 1798.100(a)-(b) | Notice at collection | data-retention |