ISO/IEC 27018 FAQ PII Return and Deletion

Start with the trigger and authorized outcome: a customer instruction, purpose expiry, retention-schedule event, contract termination, or valid legal requirement. Then define the export format and verification, timing, contract-end recovery buffer, erasure method, live systems, temporary files, logs, backups and continuity copies, subprocessor copies, archives, legal holds, and completion notice.

ISO/IEC 27018 recognizes return, transfer to another processor or controller, secure deletion or destruction, anonymization, and archival as possible dispositions. Return or transfer requires a usable export and confirmed recipient; deletion or destruction requires a defined mechanism; anonymization requires evidence that the result is no longer identifiable by reasonably likely means; archival requires a valid purpose, restricted access, and a retention end. None should be used to avoid a required return or deletion.

Keep the authorized instruction, purpose and retention trigger, inventory and system scope, export manifest and receipt, deletion jobs and logs, temporary-file cleanup result, backup expiry schedule, subprocessor confirmations, legal-hold record, verification sample, exceptions, and completion notice.

For backups that cannot be selectively erased without harming integrity, document the technical constraint, access restriction, fixed expiry, restoration procedure, and rule that returns restored data to the deletion queue before normal use. ISO/IEC 27018 does not set one universal deletion period; the policy and contract should state the applicable period.

Cloud operations performs disposition; privacy and records owners validate the inventory and retention schedule; legal confirms a legal hold or statutory retention basis; supplier management obtains subprocessor results; the service owner confirms the customer outcome and unresolved copies.

A retention exception should identify the specific data, authority, owner, access restriction, end condition, and review date. Keep excepted data isolated from ordinary processing and delete it when the exception ends.

Retest for platform, backup, storage, logging, subprocessor, contract, retention, legal-hold, or termination-workflow changes and after a failed or partial deletion.

Test the complete path: customer authorization, export if requested, deletion from active stores and temporary files, backup expiry, subprocessor completion, exception handling, verification, and customer confirmation.