SOC 2 P4.3: Privacy - Disposal of Personal Information

Define secure disposal methods for every storage type. For databases, delete with transaction logging and verification. For files, use secure delete utilities or an encrypt-then-delete approach. For physical media, follow NIST SP 800-88 guidelines. For cloud storage, use provider deletion APIs and verify removal from all replicas.

Address every copy of the data. When you delete personal information from production, also handle copies in staging and test environments, database replicas, caches and CDN edge locations, analytics and warehouse systems, email and collaboration tools, and any third-party services holding copies. Build a checklist per data type so nothing gets missed.

Verify that disposal is complete. After deletion, confirm the data is no longer accessible from any system. Run spot checks, query the relevant tables, and review audit logs. For physical media destruction, obtain and retain certificates of destruction.

Build a process for individual deletion requests. Under GDPR and CCPA, people have the right to request erasure of their data. Define clearly which systems are in scope, which data elements get deleted, what the timeline is, what exceptions apply (legal holds, regulatory requirements), and how you confirm completion to the individual.

Handle third-party disposal. When you terminate a vendor relationship or when a vendor holds data that should be destroyed, your contracts need to require certified destruction. Get written confirmation and verify where possible.

Keep disposal records. Document what was disposed of, when, using what method, from which systems, and who performed or verified the action. These logs are essential audit evidence and help you respond to data subject enquiries about whether their information has been removed.