Clause 9 · Title coverage

Requirements for implementation

Clause 9 is the largest clause and the one the DIS expands most. It covers organisation wide aspects such as backup, logs, transmission, repair and disposal, individual systems, manual processes, processors, exceptions and individual deletion requests.

Citation: ISO/IEC DIS 27555, Clause 9. Held: Contents only.

What the draft asks of an organisation

The clause turns the framework into operating requirements. At organisation level it addresses backup, logs, transmission systems, repair and dismantling, disposal of systems and components, and everyday business life. It then addresses individual IT systems, regular manual processes and the position of a PII processor. It adds control of deletion in special cases, split into exception management and further sets of PII, and it requires a route for an individual request to delete or suspend deletion. The DIS contents shows clause 9 growing from about five pages to about eight, which is the clearest structural signal in the revision: implementation and the individual request route have been given more room.

What the public sample holds

The DIS contents lists 9.1 to 9.8, including the six parts of 9.3 and the two parts of 9.7. The clause text is not in the public sample and is not held, so this page states the implementation work the contents and the scope imply, not the draft's sentences.

What this clause covers, in our reading

Clause 9 is where a deletion policy meets the estate. The organisation wide list is a map of the places records escape the live system. Backup keeps a copy after the rule has run. Logs record the deletion itself and can contain the very identifiers that were meant to go. Transmission systems leave copies in queues, mail gateways and partner inboxes. Repair and dismantling can move a disk to a third party. Disposal of components is the end of the line and needs a record. Everyday business life covers the paper, the notebooks, the whiteboards and the desk drawers. The individual system part asks for the same thinking one application at a time, because a central policy that never reaches the application owner does not delete anything. Manual processes matter because a paper file cannot be deleted by a script. The processor part is the contractual route: the controller must be able to show that a processor follows the rules, and the processor must be able to show what it did. The special cases are exception management and further sets of PII, which is the draft's way of saying that a deletion framework must survive the record that does not fit. The individual request route is the operational face of the right to erasure. A request can ask for deletion or for suspension, and the organisation needs a path that reaches every cluster, records the decision and proves the outcome. The DIS gives this clause more space than the earlier edition, and a team updating a policy should treat the expansion as the work plan.

Subclauses named in the contents

• 9.1 General
• 9.2 Conditions for starting points outside IT systems
• 9.3 Requirements for implementation for organization-wide aspects
• 9.3.1 General
• 9.3.2 Backup
• 9.3.3 Logs
• 9.3.4 Transmission systems
• 9.3.5 Repair, dismantling and disposal of systems and components
• 9.3.6 Everyday business life
• 9.4 Requirements for implementation for individual IT systems
• 9.5 Deletion in regular manual processes
• 9.6 Requirements for implementation for PII processor
• 9.7 Control deletion in special cases
• 9.7.1 Exception management
• 9.7.2 Further sets of PII
• 9.8 Handle individual requests for deletion or suspension of deletion

What to prepare

1. Walk the organisation wide list and assign an owner and a control to each item: backup, logs, transmission, repair, disposal and everyday business life.
2. Pick the three systems with the most PII and write an implementation note for each.
3. Map the manual processes that hold PII and add a destruction step with a witness or a log.
4. Collect the processor contracts and confirm each has a deletion instruction and a return or destruction clause.
5. Write the individual request route with a ticket, a decision record and an evidence pack.

The evidence an auditor or regulator asks for

Tests to run

• Pick a device sent for repair and trace the deletion or retention decision.
• Pick a log store and confirm it does not outlive the record it describes without a rule.
• Submit a test individual request and follow it to every cluster.
• Ask a processor for the last deletion certificate.

What the public text does not settle

• The clause text is not in the public sample and is not stated here.
• The draft does not set technical standards for logs or backup.
• The draft does not say what a processor certificate must contain.

Next

• Use the 9.1 to 9.8 list as the implementation work plan.
• Run the individual request test before the next audit cycle.

Other clauses

• Clause 1: Scope
• Clause 2: Normative references
• Clause 3: Terms and definitions