Clause 3 · Full public text

Terms and definitions

Ten defined terms carry the method: cluster of PII, data object, deletion, deletion class, deletion rule, deletion period, standard deletion period, regular deletion period, retention period and legal retention period. The draft changes the notes to deletion and moves the detail on mechanisms into clause 5.

Citation: ISO/IEC DIS 27555, Clause 3. Held: Full public text.

What the draft asks of an organisation

The draft defines ten terms and takes the rest of its vocabulary from the privacy framework. The definitions do the structural work. A cluster of PII is information processed for one consistent functional purpose, not a database table. A data object is the element that contains the information, and deletion is applied to the object as a whole. Deletion is a process that makes the information unrecognisable and unusable except at excessive cost, and the draft lists erasure, destruction and destruction of storage media as synonyms. A deletion rule pairs a deletion period with a specific starting condition. A deletion class pairs a standard deletion period with an abstract starting point. The period ladder runs from the general deletion period through the standard and regular forms to the retention period and the legal retention period. The DIS keeps all ten terms and rewrites the notes to deletion so that the detail on bit patterns and mechanisms sits in clause 5 rather than in the definition.

What the public sample holds

All ten terms and their notes are in the ISO Online Browsing Platform free preview. The DIS sample carries 3.1 at the point where its public extract ends.

What this clause covers, in our reading

The vocabulary is where most deletion projects fail quietly. Teams use the word retention for the period a record must be kept and the word deletion for the moment it is removed, then discover that the gap between the two is a process nobody owns. The draft separates them: retention is the time the record must remain available, and the deletion period extends beyond it by at least the time the deletion itself needs. A second common failure is treating a table as a cluster. The draft ties a cluster to a functional purpose, so one customer record can appear in several clusters and one cluster can draw on several systems. A third failure is writing a rule without a starting point. A period of seven years means nothing until the event that starts the clock is named, such as the end of the contract, the last payment or the closure of the case. The DIS also separates the abstract from the specific. A deletion class is a reusable combination of a standard period and an abstract start, while a deletion rule is the specific version for one cluster. That separation is what lets an organisation run a small matrix instead of a rule per record type. The new notes make the definition of deletion less about a single technical act and more about an outcome that can be demonstrated.

Subclauses named in the contents

• 3.1 cluster of personally identifiable information
• 3.2 data object
• 3.3 deletion
• 3.4 deletion class
• 3.5 deletion rule
• 3.6 deletion period
• 3.7 standard deletion period
• 3.8 regular deletion period
• 3.9 retention period
• 3.10 legal retention period

What to prepare

1. Build a one page glossary with the ten terms, the organisation's own example for each, and the system where it is used.
2. For every deletion rule in force, write the starting event next to the period and test whether two readers would start the clock on the same day.
3. Check whether any team uses retention period and deletion period as synonyms, and correct the policy wording.
4. Record which clusters exist for one record type, including copies in other functions.

The evidence an auditor or regulator asks for

Tests to run

• Give five staff the same end date and ask each to calculate the deletion date from the rule.
• Pick a record that exists in two functions and confirm both clusters and both rules.
• Check that no rule in the schedule lacks a starting event.

What the public text does not settle

• The draft does not define a deletion mechanism, because it puts mechanisms outside scope.
• The draft does not say how to treat a record whose legal retention period is uncertain.
• The draft does not set a naming convention for clusters beyond clear functional naming.

Next

• Adopt the glossary in the policy and in the system inventory.
• Rewrite any rule that has a period but no start event.

Other clauses

• Clause 1: Scope
• Clause 2: Normative references
• Clause 4: Symbols and abbreviated terms