If your SOC 2 scope includes Confidentiality, you must identify confidential information and dispose of it when it is no longer needed. In practice that means a retention schedule by data type, a deletion process that actually runs, and records that show it ran. Write only the rules you can follow.
What the criteria ask
The Confidentiality category has two criteria. C1.1 is about identifying and maintaining confidential information. C1.2 is about disposing of confidential information when it is no longer needed to meet your objectives. The criteria set no retention length. You choose it, then show you follow it.
Even if you do not add the category, retention still matters. Customer contracts, privacy law and your own commitments often set deletion terms.
Build the schedule
List the data types you hold, then set an owner and a period for each.
- Customer content and account data.
- Logs and audit trails.
- Backups and snapshots.
- Support tickets and email.
- Employee records and background check results.
- Security evidence such as access review exports.
- Analytics and telemetry.
For each, write the reason for keeping it, the period, and the deletion method. Regulations, contracts and audit needs may set minimum periods, so check them with legal advice before choosing short ones.
The hard parts
Backups. Deleting from production does not delete from last month's backup. State the backup retention and say that deleted data ages out with the backup cycle. Be honest about it in customer commitments.
Logs. Logs can contain personal data. Decide how long they stay and whether sensitive fields are masked.
Third parties. If a vendor holds your data, deletion depends on them. Your vendor terms should cover it.
Customer exit. Define what happens when a customer leaves: export window, then deletion, then confirmation.
Prove it runs
Auditors want evidence of the process, not the paragraph.
- A deletion job log, a ticket, or a script run record with dates.
- A sample of customer deletion requests and their completion.
- Disposal records for hardware, such as a wipe record or vendor certificate.
- A review of the schedule on a stated cycle.
If deletion is manual, make a recurring ticket so it happens and leaves a trail.
Keep claims and practice aligned
Your privacy notice, contracts and security questionnaire answers should match the schedule. A promise to delete within a short window that your backups cannot meet is a finding waiting to happen.
Safeguard's compliance and evidence automation can hold dated evidence of recurring tasks like these, while the deletion itself runs in your own systems.
Quick check
Do we have to delete data on a fixed day?
Not by the criteria. You set the rule and must follow it. Contracts or law may add fixed periods.
Is Confidentiality required?
No. Security is the base category. Confidentiality is optional and is added when customers expect it.
Sources
Last reviewed: 19 October 2026.
