Data Retention and Deletion

[Applicable to all service providers]
1. Establish and document data retention policy to specify retention, archiving, and data deletion requirements in accordance with legal, regulatory and business requirements, including contractual obligations. Review and update the policy periodically to keep it current.

2. Create agreements to specify data deletion, retention, and archiving requirements, ensuring compliance with applicable laws and regulations to subprocessors. Obtain a certificate of destruction if using a managed service provider.

3. Maintain audit logs, backups, and redundancy for disaster recovery in accordance with data retention policy. Set up a decommissioning process to destroy defective disks so data cannot be recovered.

4. Implement tools for secure data deletion, including NIST 800-88 compliant data wiping and secure disposal of records.

5. Establish a process to comply with requests to destroy customer data within agreed time periods and provide written certification of destruction.

8. Establish a process to delete customer data after service termination.

1. Verify if infrastructure-level policies define roles and responsibilities for retention, archiving, and deletion of customer data and system telemetry.

2. Verify if data types (e.g., VM snapshots, training datasets, system logs), owners, and retention timeframes are documented and comply with SLAs and regulations.

3. Verify if infrastructure logs and tenant data are archived or deleted in line with the documented retention policy.

4. Verify if supplier and subprocessor agreements include data lifecycle terms aligned with customer and legal expectations.

5. Verify if customer or internal data is purged using secure, verifiable deletion practices at the infrastructure level.

6. Verify if deletion and archiving events are logged, monitored, and retained for audit purposes.

7. Verify if access to retained system and customer data is controlled and monitored to prevent leaks or breaches.

8. Verify if data retention policies are reviewed and updated in accordance with regulatory developments and technology lifecycle changes.

9. Verify if retention policies account for AI-specific data stored or processed through the infrastructure (e.g., model checkpoints).

10. Verify if AI platform services are configured to limit unnecessary retention of customer AI data.

11. Verify if de-identification tools are available or enforced for customer data used in AI processing pipelines.

12. Verify if AI-related customer data is protected by role-based access and encryption-at-rest/in-transit policies.

13. Verify if systems include automated workflows to delete expired AI data and workloads securely.

14. Verify if infrastructure monitoring systems provide visibility into compliance with AI-related data retention policies.