← SOC 2 · C1 — Confidentiality
C1.2 — Disposal of confidential information
medium
data-deletiondata-retention
Requirement
The entity disposes of confidential information to meet its objectives related to confidentiality.
What the engine looks for
Every group below must be satisfied — by an affirmative statement, not a plan, a hedge or a denial — for the control to count as covered. A term ending in … matches any word it begins. Supporting terms do not change the verdict — they raise confidence and distinguish a policy that names a mechanism from one that gestures at a category.
Required element 1 — any one of
disposedisposaldeletedeletiondestroypurge
Required element 2 — any one of
retentionscheduleperiodconfidentialretain
Supporting terms — specificity signals
automated deletionttllifecycle policycertificateverified
Equivalent controls elsewhere
Matched on shared topics. Satisfying this control usually moves these too.
| Framework | Control | Title | Shared topics |
|---|---|---|---|
| GDPR | Art.5(1)(e) | Storage limitation | data-retention data-deletion |
| ISO 27001 | A.8.10 | Information deletion | data-deletion data-retention |
| PCI DSS 4.0.1 | 3.2 | Minimise storage of account data | data-retention data-deletion |
| GLBA | 314.4(c)(6) | Secure disposal within two years and periodic review of retention | data-deletion data-retention |
| COPPA | 312.10 | Written data retention policy for children's information | data-retention data-deletion |
| GDPR | Art.17 | Right to erasure (“right to be forgotten”) | data-deletion |
| CCPA/CPRA | 1798.100(a)-(b) | Notice at collection | data-retention |
| CCPA/CPRA | 1798.105 | Right to delete | data-deletion |