Home / Answers / What evidence does an auditor ask for when you delete PII?
Answer · from the public record
What evidence does an auditor ask for when you delete PII?
An auditor asks for five things: a register that names each cluster and its rule, a period specification with a start event, a completion record for the last deletion run, a route for individual requests, and a certificate or instruction for each processor. The policy alone is not evidence.
Last updated: 2026-10-22. Evidence level: public record and public sample. The licensed text is not reproduced.
The register and the rule
The first question is what the organisation holds and why. A cluster register with a purpose, an owner, the data objects and the rule answers it. The register has to be readable by a business owner, not only by a data engineer, because the purpose is a business decision.
The period specification
The second question is when the record should have gone. A period without a start event cannot answer it. The specification needs the period, the event that starts it, the event that stops it and the evidence that the clock was read correctly. A legal hold needs an end date and a reviewer.
The completion record
The third question is what happened on the last run. A completion record with a date, an operator, the cluster and the count of objects is the minimum. A log of deletion that itself contains the identifiers needs its own rule, or the evidence becomes a new retention problem.
The individual request
The fourth question is what happens when one person asks for deletion or for a suspension. The DIS introduction adds individual requests and clause 9.8 owns the route. A ticket, a decision, an outcome and a check across every cluster is the evidence.
The processor
The fifth question is what the suppliers did. A processor instruction and a completion certificate per processor is the usual evidence. If a processor cannot provide one, that is a finding, not a gap in the draft.
Check the source. The full record, the stage trail and the clause pages are free. Start with the clause 9 page.