Control 8.10 asks you to delete information when it is no longer required. Its aims are to reduce the risk of sensitive data leaking and to support privacy and other laws. Define what is deleted and when, who does it and by what method, and keep evidence that deletion really happens.
Why it exists
Data you no longer need still has to be protected, and it can still leak. Deleting it removes the risk. The control is new in the 2022 edition, which reflects how much privacy law now shapes security work.
Decide the rules first
Deletion should be planned around regulatory or contractual requirements and your own risk assessment. A short table is enough:
For each data type, write down:
- How long you keep it, and why (contract, law or business need)
- Which role deletes it
- Which method is used
For example, customer support tickets might be kept for a set period because of a contract, then deleted by a named role using a defined method.
Set the periods from your legal and contractual duties. Do not guess them. If you cannot confirm a retention period, have someone with legal knowledge check it.
Methods
Two families are named in the guidance:
- Software methods, such as wiping tools that overwrite storage.
- Hardware methods, such as paper shredders.
For cloud and database systems the method is usually a delete operation plus an agreed handling of replicas and archives. The guidance I used does not address backups or cloud specifically, so decide those cases in your own procedure and be able to explain them to an auditor.
Rehearse one deletion
Pick one data set, delete it following your own procedure, and keep the evidence. Doing it once exposes the gaps, such as a replica nobody listed, long before the auditor asks.
Where the rule lives
You can document it in a disposal and destruction policy, an acceptable use policy, or IT security procedures. Smaller and mid sized companies can use an IT security policy. Larger companies may prefer a separate disposal and destruction policy. These documents are recommended, not mandatory.
People
Staff should understand why deleting sensitive information matters and be trained on how to do it properly. Include contractors who handle data.
What the auditor tests
Auditors may look for evidence that data no longer required is deleted, regardless of where it is stored. That phrase matters. If your policy covers the production database but not laptops, shared drives and test environments, expect a question.
Good evidence includes:
- A dated deletion log or ticket.
- A sample showing old records gone from a system.
- Certificates or records for destroyed hardware.
- Proof that test copies of production data are removed.
Quick check
Does deletion apply to backups?
The control says data should be deleted wherever stored. Decide how backups are handled, document it, and be ready to explain the timing.
Is a retention schedule mandatory?
Not by name. But you need a defined basis for when data is no longer required, and a schedule is the simplest way to show it.
Sources
Last reviewed: 19 October 2026.
