Clause 1 · Full public text

Scope

The draft is guidance for the policies and procedures an organisation uses to delete personally identifiable information. It sets a common vocabulary, a way to define deletion rules, the documentation to keep and the roles and processes behind them, and it leaves the law and the deletion tools to others.

Citation: ISO/IEC DIS 27555, Clause 1. Held: Full public text.

What the draft asks of an organisation

An organisation that stores or processes personally identifiable information is the audience. The draft sets out to give it four things: one shared vocabulary for deletion, a practical way to define deletion rules, a description of the documentation those rules need, and a broad statement of roles, responsibilities and processes. It is a guidance document, so it uses should rather than shall for the substance. It deliberately does not decide the legal position for any jurisdiction, does not write the deletion rules for a particular set of records, does not choose or test deletion tools, and does not cover de-identification techniques. Those four exclusions matter when a team is tempted to treat the draft as a compliance certificate. It is the method for building the deletion framework, not the framework's legal content.

What the public sample holds

Clause 1 is in the free preview in full, in both the DIS sample and the ISO Online Browsing Platform.

What this clause covers, in our reading

Clause 1 decides every later argument about what the draft can and cannot be used for. It starts from the organisation that holds the records, not from a product or a tool. The four deliverables it names are the shape of the work: agree the words, define the rules, document the rules, and assign the people and the process. A team that writes a deletion schedule but never agrees what deletion means, or never says who approves an exception, has done one quarter of what the clause describes. The exclusions are just as practical. The draft will not tell a bank how long it must keep a transaction record, because that is set by law. It will not tell a hospital which fields belong in a patient cluster, because the controller decides that. It will not compare secure erase tools, and it will not turn a record into an anonymous data set. Each of those is a separate decision with its own evidence. The clause also frames deletion as a control that supports privacy principles rather than a standalone project. That framing is why the draft sits beside a privacy framework and a privacy information management system instead of replacing either of them.

What to prepare

1. Write a one page scope note that names the entities, the countries and the record types the deletion framework covers.
2. List the four deliverables from the clause and mark which one the organisation already has, with the document name and owner.
3. Record the four exclusions in the scope note, so no reader expects the framework to settle a legal retention period or to select a tool.
4. Name the privacy principles the deletion framework is meant to serve, and link each to an existing policy line.

The evidence an auditor or regulator asks for

Tests to run

• Ask three staff what deletion means in this organisation and compare the answers with the defined term.
• Pick a record type and trace it to a rule, an owner and a document, or record the gap.
• Check that no page of the framework claims the draft determines a legal retention period.

What the public text does not settle

• The draft does not say how many clusters or rules an organisation should have.
• The draft does not set a minimum documentation set beyond the description in clause 5.8.
• The draft does not allocate responsibility between the controller and the processor beyond clause 9.6.

Next

• Use the scope note as the front page of the deletion policy.
• Send the scope note to the legal owner for the jurisdictions named.

Other clauses

• Clause 2: Normative references
• Clause 3: Terms and definitions
• Clause 4: Symbols and abbreviated terms