DAT-04 · Data and Privacy
Complete disposal
Data is removed from primary systems, backups, caches, exports and third parties when it is no longer needed or on request.
6frameworks fully address it
0partially
2leave it out
SOC 2 ISO 27001 NIST CSF PCI DSS HIPAA GDPR EU AI Act NIST AI RMF
1Where each framework asks for it
- SOC 2FullCC6.5
- ISO 27001FullA.8.10
- NIST CSFFullPR.DS-03
- PCI DSSFull3.2.1
- HIPAAFull164.310(d)(2)(i)
- GDPRFullArt. 17
- EU AI ActAbsent No disposal obligation; record-keeping durations are specified instead.
- NIST AI RMFAbsent Out of scope: the framework addresses AI risk, not data lifecycle disposal.
Build the control once against this objective and cite the clause each auditor asks about. A partial mapping says what the framework leaves out; an absence is a finding about the framework, not a gap in your program.
2What usually proves it
Disposal procedure, backup expiry evidence, third-party confirmations.
?Why it exists
Deletion that stops at the database is not deletion.
For a smaller organizationKnow your backup horizon and state it honestly.