What evidence does SOC 2 SOC2-P4.2 need?

Retention schedule for personal information categories. Evidence of automated retention enforcement. Legal hold procedure

SOC2-P4.2 of SOC 2, stated here in our words and cited to that clause.

Does it map to the other framework?

Yes, to 1 criteria in the other framework, each with a confidence and a reason. A link is a topical overlap, not a legal equivalence.

SOC 2 SOC2-P4.2 evidence: P4.2 Retaining personal

SOC 2 SOC2-P4.2: P4.2 Retaining personal information

SOC 2 SOC2-P4.2 covers P4.2 Retaining personal information. The held text names 3 evidence records for it, the first being Retention schedule for personal information categories. The common gap an assessor flags is Personal data retained indefinitely.

Personal information is retained in line with privacy objectives. Points of focus: it is kept no longer than needed for the stated purposes unless law requires otherwise; and it is protected from erasure or destruction during its retention period.

What evidence supports SOC2-P4.2?

RetentionRetention schedule for personal information categories
RetentionEvidence of automated retention enforcement
RetentionLegal hold procedure

Where this requirement comes from

This is our own statement of SOC 2 SOC2-P4.2, read from the copy we hold (issuer free complete copy) and stated in our words, not the standard verbatim. The framework as we hold it.

Common gaps an assessor flags

Personal data retained indefinitely
Retention schedule not implemented in systems
Premature deletion undermining legal obligations

How it maps to ISO 27001:2022

5.34 high Retention limits on personal information evidence the PII preservation requirements being met.

A link is a topical overlap with a confidence and a reason. It does not establish that meeting one requirement satisfies the other, and it is not certification.