SOC 2 · P - Privacy
SOC 2 P4.3: P4.3 Securely disposing of personal information
SOC 2 P4.3 covers P4.3 Securely disposing of personal information. The held text names 3 evidence records for it, the first being Deletion request log with completion evidence. The common gap an assessor flags is Deletion requests not tracked to completion.
Personal information is disposed of securely in line with privacy objectives. Points of focus: deletion requests are captured and the related information flagged for destruction; information no longer retained is anonymised, disposed of or destroyed in a way that prevents loss, theft, misuse or unauthorised access; and policies and procedures destroy information identified for destruction.
What evidence supports P4.3?
- Data disposalDeletion request log with completion evidence
- Data disposalAnonymisation or destruction procedure
- Data disposalDeletion job logs covering primary stores and backups
Where this requirement comes from
This is our own statement of SOC 2 P4.3, read from the copy we hold (issuer free complete copy) and stated in our words, not the standard verbatim. The framework as we hold it.
Common gaps an assessor flags
- Deletion requests not tracked to completion
- Deleted records persist in logs, exports or backups beyond a defined window
- Pseudonymised data treated as anonymised
How it maps to ISO 27001:2022
- 8.10 high Secure disposal of personal information evidences deletion when retention purpose ends.
A link is a topical overlap with a confidence and a reason. It does not establish that meeting one requirement satisfies the other, and it is not certification.