Data Lifecycle, Retention, and Disposal Controls
Data you cannot find is data you cannot delete
This domain covers classification, minimization, retention scheduling, and disposal. The auditor needs a working knowledge of the lifecycle: collection, use, sharing, storage, archival, and destruction, with controls at each stage. Classification schemes drive handling rules, so the auditor checks that data is actually labeled and that labels match the handling applied.
Retention is the highest-yield area for findings. A retention schedule must map categories of data to defined periods tied to a legal or business justification, and systems must enforce those periods rather than rely on memory. Auditors look for automated deletion jobs, evidence they ran successfully, exception handling for legal holds, and confirmation that deletion reached replicas, backups, archives, and vendor copies. The trap is the schedule that exists only on paper while production tables hold records from a decade ago.
Disposal requires more than a delete command. For media and devices, the auditor wants certificates of destruction or verified sanitization consistent with recognized standards. For cloud data, the question is cryptographic erasure and contract terms on vendor deletion.
Minimization is tested by comparing collected fields against stated purposes; unused fields are a finding even when no breach occurred.
Worked example. A retention policy sets 24 months for closed customer accounts. Testing shows the automated job excludes accounts flagged "dormant," a flag applied to 12% of records. Those records are never deleted. The finding is a control design gap in the job logic, with a remediation to remove the exclusion and run a catch-up purge.
Rule of thumb: follow one record from creation to destruction and confirm every copy, including backups and vendor systems, has an owner and an end date.