ISO 27555 clauses: the ten clause record

One page per clause, written from the public record and the public sample. Each page states the citation, what the draft asks of an organisation, what the public sample holds, the evidence an auditor asks for and the tests to run.

Ten clauses, the evidence level of each, and the one line answer.
Clause	Title	Evidence level	One line
1	Scope	Full public text	The draft is guidance for the policies and procedures an organisation uses to delete personally identifiable information. It sets a common vocabulary, a way to define deletion rules, the documentation to keep and the roles and processes behind them, and it leaves the law and the deletion tools to others.
2	Normative references	Full public text	One document is normative: ISO/IEC 29100:2011, the privacy framework. Its principles supply the reason deletion matters, and the draft assumes the reader can use them. No other standard is binding through clause 2.
3	Terms and definitions	Full public text	Ten defined terms carry the method: cluster of PII, data object, deletion, deletion class, deletion rule, deletion period, standard deletion period, regular deletion period, retention period and legal retention period. The draft changes the notes to deletion and moves the detail on mechanisms into clause 5.
4	Symbols and abbreviated terms	Title coverage	The clause lists the abbreviations the draft uses. The DIS adds solid state disk and write once read many storage to the earlier list, which is a small but useful signal that removable and optical media are no longer the only carriers in view.
5	Framework for deletion	Public text to 5.5	Clause 5 is the method. An organisation names its clusters of PII by purpose, sets retention and deletion periods, groups clusters into a small number of deletion classes, and documents the policy and the procedure. The DIS sharpens the language on deletion processes and adds current storage technology.
6	Clusters of PII	Title coverage	Clause 6 turns the cluster idea into an exercise: identify the clusters by purpose, then document each one so that a reader can see which data objects belong to it and which rule applies. It is the bridge between a data inventory and a deletion schedule.
7	Specification of deletion periods	Title coverage	Clause 7 is where periods become specifications. It separates standard from regular periods, says how to identify the standard period for a cluster, and covers the special situations that bend the rule: changed records, delayed deletion, suspension and backups.
8	Deletion classes	Title coverage	Clause 8 makes the rule set manageable. It defines abstract starting points, builds a matrix of deletion classes, and shows how a cluster is allocated to a class and given a specific deletion rule.
9	Requirements for implementation	Title coverage	Clause 9 is the largest clause and the one the DIS expands most. It covers organisation wide aspects such as backup, logs, transmission, repair and disposal, individual systems, manual processes, processors, exceptions and individual deletion requests.
10	Responsibilities	Title coverage	Clause 10 closes the loop on ownership. It covers the general allocation of responsibility, the documentation that proves it, and the implementation that makes it real, including the deletion mechanisms the framework relies on.

How to read the evidence level. Full public text means the clause is in the free OBP preview. Public text to 5.5 means the clause is held from the public sample but the sample stops inside it. Title coverage means the DIS public sample does not carry the text, so the page states the purpose and the work and never invents the requirement.

The 45 subclauses

The public contents names 45 subclauses under the ten clauses. They are listed with their titles and the clause page that carries them on the structure page. The paid kit turns all 55 rows into a register with an owner, a status and a due date.

The four markets and the rules we hold

The deletion framework sits inside a privacy regime. For each market below, the held frameworks that genuinely apply to an organisation holding PII are named in market order. Where a regime is not held, it is named and not stated.

United States

There is no federal privacy statute in the held set. The state consumer privacy statutes are held, for example the Texas Data Privacy and Security Act and the Montana Consumer Data Privacy Act, and they apply only to an organisation in their scope. They are named here as context, not relied on for a requirement. The federal position is named, not held.

European Union

The GDPR is held and is the primary regime for an organisation offering goods or services in the Union. The ePrivacy Directive is held and applies to electronic communications. The deletion framework supports the storage limitation principle and the erasure right in the GDPR.

United Kingdom

The UK GDPR and the Data Protection Act 2018 are held. The same storage limitation and erasure duties apply in UK law, and the Act supplies the domestic framework around them.

Australia

The Privacy Act 1988 and the Australian Privacy Principles are held. APP 11 requires destruction or de-identification when personal information is no longer needed. The OAIC Privacy Management Framework is held as the regulator's governance guidance.

The regimes decide the legal retention periods and the erasure rights. This record does not state those periods; it states the deletion method the draft describes. Check the law of your own jurisdiction separately.

Where to start

If you own the deletion procedure, read clause 5, then clause 6, clause 7 and clause 8. If you own the estate, read clause 9 first. If you have to approve the work, read what changed and run the check.