Information deletion

Plain-language summary

New in 2022: deleting information from systems, devices, storage media and cloud services once it is no longer needed, using methods that suit its sensitivity, so that old data cannot be leaked or stolen and is not kept longer than the law allows.

What the clause is really asking

Information you no longer need is pure risk: it can still be breached, it still has to be searched in an access request, and in South Africa keeping it may be unlawful. POPIA section 14 limits retention of personal information to what the purpose, the law or a contract requires, and requires records no longer needed to be destroyed, deleted or de-identified as soon as reasonably practicable, in a way that prevents reconstruction. The control turns that into practice: decide when information must be deleted, usually through a retention schedule; choose deletion methods proportionate to sensitivity, from ordinary deletion through secure overwriting to cryptographic erasure or physical destruction; remove copies and old versions as well as the master; get evidence of deletion from service providers and cloud platforms; and record that deletion happened. The common misunderstanding is that this is equipment disposal, which is 7.14. This control is about information on live systems: old customer records in the ERP, former employees' files, mailboxes nobody has opened in years. ISO 9001 practitioners will recognise retention and disposition of documented information.

What auditors look for

Auditors ask for the retention schedule and then test it against reality. They pick a category with a defined retention period — former employees' files, unsuccessful applicants' CVs, closed customer accounts — and look for records older than the limit. They ask how deletion is carried out and recorded for live systems and backups, what the cloud provider's deletion terms are when a service ends, and how leavers' mailboxes and personal drives are handled. They ask for destruction certificates from disposal providers. The hard question: when did you last delete personal information because its retention period ended, and where is the record?

Typical evidence

Retention schedule with deletion triggers per information type; information deletion procedure specifying methods by classification; deletion logs or records per system; certificates of destruction from disposal providers; cloud and service-provider deletion terms and confirmations; records of leaver account and mailbox deletion; retention policies configured in email and document platforms; evidence of periodic retention reviews.

How to comply — recommendations

Build a retention schedule if you do not have one: each type of information, the legal or business reason for keeping it, the period, the owner and the system it lives in. Configure retention and deletion policies in Microsoft 365 or Google Workspace for mail and documents, and in the ERP or HR system where the software allows. Where it does not, diarise an annual deletion run for each owner, with a short record of what was deleted and how. Set deletion methods by classification in a one-page procedure. Add deletion clauses to supplier and cloud contracts and ask for confirmation when a service ends. Include unsuccessful applicants' CVs and expired backups; they are the usual leftovers.

Common nonconformities

No retention schedule, or one never applied; personal information held well beyond its retention period; deletion left to individuals with no record; copies and old versions retained after the master is deleted; no deletion terms with cloud providers or disposal suppliers; leaver mailboxes and files kept indefinitely; no evidence that any deletion has ever taken place.

Resources for this clause

• ArticlePOPIA section 19 and ISO 27001: how the standard evidences the law — and why a certificate is not compliance
• ArticleISO/IEC 27001:2022 Annex A explained: the 93 controls in plain English, theme by theme, with the 114-to-93 map and the attribute tags
• ArticleThe Statement of Applicability, explained — what ISO/IEC 27001 clause 6.1.3 requires, the four ways an SoA fails Stage 1, and how to build one from the risk register
• ArticleISO/IEC 27001:2022 explained for people who already run ISO 9001: what is the same, what is new, and how to get certified
• Toolkit · $39Risk & SoA ToolkitScore your information security risks on a documented method, pick the Annex A controls that treat them, and the Statement of Applicability writes its own first draft — every justification citing the risks behind it.
• Toolkit · $29ISMS Metrics & Evidence TrackerThe three things an ISMS has to show after certification, in one workbook: measures with a live Green / Amber / Red status, management review minutes that cover every required input, and an evidence register that gives every control an owner, a rhythm and a due date.
• Free downloadAnnex A 93 Controls Quick ReferenceOne A3 page: all 93 Annex A controls in their four themes, the eleven new in 2022 flagged, and the ISO/IEC 27002:2022 attribute legend — the poster for the wall beside the Statement of Applicability.
• Free downloadISO 27001 Gap Analysis ChecklistWhere you stand against ISO/IEC 27001:2022 in one afternoon — the 30 management-system requirements and all 93 Annex A controls, scored, with owners, dates and a readiness figure that calculates itself.
• Free masterclass · ~27 minISO 27001 MasterclassYou already know four fifths of ISO 27001. Here is the other fifth — the risk method, the SoA, the 93 controls, the evidence rhythm, POPIA, and a 44-week path.
• Free appAudit ManagerPlan the programme, anchor each finding to its clause and drive the NC to closure.