Clause 7 · Title coverage

Specification of deletion periods

Clause 7 is where periods become specifications. It separates standard from regular periods, says how to identify the standard period for a cluster, and covers the special situations that bend the rule: changed records, delayed deletion, suspension and backups.

Citation: ISO/IEC DIS 27555, Clause 7. Held: Contents only.

What the draft asks of an organisation

The clause builds on the period vocabulary and gives the organisation a method for writing periods down. A standard deletion period is a reusable period chosen for several clusters. A regular deletion period is the outer limit for a cluster in normal processing, made of the retention period plus the time the deletion process needs. The clause also addresses the cases that do not fit a simple timer. A data object can change after it was created, which can restart or change the period. A record can be moved to another cluster, which postpones deletion under the new cluster's rule. A deletion can be suspended, for a legal hold or an investigation. A backup can hold a copy after the live record has gone. Each of those needs a decision and a record, because each is a place where a deletion date can be quietly missed.

What the public sample holds

The DIS contents lists 7.1 to 7.4 and the five subclauses of 7.4. The clause text is not in the public sample and is not held. The page states the purpose and the work, not the draft's sentences. The earlier edition names 7.4.3 as the need to extend a period of active use; the DIS turns that heading into a rule for a record moved to a different cluster.

What this clause covers, in our reading

The most valuable output of clause 7 is a period specification that two people can apply the same way. That requires four fields on every row: the period, the event that starts it, the event that stops it, and the evidence that the clock was read correctly. A period without a start event is a wish. A period without a stop event cannot handle a contract that is renewed or a case that reopens. The distinction between standard and regular periods is what keeps the schedule small. A standard period is a policy choice, applied to several clusters. The regular period is the operational limit for one cluster, and it can be longer because the deletion itself takes time. The special situations are where audits find the real failures. A record that was modified after creation may need a fresh period, and the register must say so. A record moved to another cluster for a legitimate purpose must show the move and the new rule. A legal hold must be recorded with an end date and a reviewer, or it becomes a permanent exemption. A backup copy must have a documented treatment, because the live record's deletion does not remove it. None of these is exotic. They are the normal life of a record, and the clause exists because a simple timer cannot describe them.

Subclauses named in the contents

• 7.1 Standard and regular deletion periods
• 7.2 Regular deletion period specifications
• 7.3 Standard deletion period identification
• 7.4 Deletion period specifications for special situations
• 7.4.1 General
• 7.4.2 Modification of data objects
• 7.4.3 Delayed deletion by allocation to another cluster of PII
• 7.4.4 Suspension of the deletion
• 7.4.5 Backup copies

What to prepare

1. Rewrite every period as a specification with a period, a start event, a stop event and an evidence line.
2. List the events that can extend or restart a period, and decide for each whether the rule changes or the clock restarts.
3. Create a legal hold register with an owner, a reason, a start date and a review date.
4. Write the backup treatment for each cluster and agree it with the backup owner.

The evidence an auditor or regulator asks for

Tests to run

• Pick a renewed contract and confirm the start event gives the same answer to two reviewers.
• Pick a legal hold and confirm the suspension has an end date and a reviewer.
• Confirm a backup copy is covered by the treatment note, not left implicit.

What the public text does not settle

• The clause text is not in the public sample and is not stated here.
• The draft does not set any period length.
• The draft does not say how a suspension interacts with a statutory retention period.

Next

• Finish the period specification before clause 8, because the matrix depends on it.
• Give the legal hold register to the privacy owner for sign off.

Other clauses

• Clause 1: Scope
• Clause 2: Normative references
• Clause 3: Terms and definitions