Free ebook: NIS2 ready using ISO 27001 best practices
Download ebook

Personnel guidelines for safe disposal of paper data

Critical
High
Normal
Low

Papers containing sensitive information should be disposed of in an agreed manner, for example, using a shredder or by incineration.

Connected other frameworks and requirements:
8.3.2: Disposal of media
ISO 27001
I17: Salassa pidettävien tietojen jäljentäminen - Tulostus ja kopiointi
PR.DS-3: Asset management
NIST CSF
PR.IP-6: Data destruction
NIST CSF
A.11.7: Secure disposal of hardcopy materials
ISO 27018

Archiving and destruction processes for data sets

Critical
High
Normal
Low

Organization must document the retention periods for data sets and their possible archiving process (including archiving method, location or destruction). At the end of the retention period, the data must be archived or destroyed without delay in a secure manner.

When destroying data contained in data systems, the following points should be taken into account:

  • suitable method of destruction (e.g. overwriting, cryptographic erasure ) is chosen taking into account the functional and statutory requirements
  • the need to preserve evidence of data destruction is discussed
  • when using third parties for data destruction, the requirement of evidence and the inclusion of destruction requirements in supplier contracts are discussed

The process of archiving or destroying data is defined in connection with the documentation, and the owner of the data is responsible for its implementation.

Connected other frameworks and requirements:
PR.IP-6: Data destruction
NIST CSF
A.7.4.5: PII de-identification and deletion at the end of processing
ISO 27701
A.7.4.8: Disposal
ISO 27701
8.10: Information deletion
ISO 27001

Defining and documenting retention times for data sets

Critical
High
Normal
Low

Limiting the retention time is one of the principles of the processing of personal data. If the retention period of the data is not provided by law, when determining the retention periods, the following must be taken into account, for example:

  • the necessity of the data for its original processing purpose
  • implementation and verification of the interests, rights, obligations and legal protection of a natural or legal person
  • the legal effect of the contract or other legal action in civil matters
  • statutory limitation periods
  • criminal limitation periods

Describe your own process for evaluating retention periods.

Connected other frameworks and requirements:
5 luku, 21 §: Tietoaineistojen säilytystarpeen määrittäminen
5. Principles relating to processing of personal data
GDPR
18.1.3: Protection of records
ISO 27001
PR.IP-6: Data destruction
NIST CSF
A.7.4.2: Limit processing
ISO 27701

Process for secure disposal of removable media containing confidential information

Critical
High
Normal
Low

Unnecessary media should be disposed of in a safe, industry-accepted manner (such as by incineration, shredding or wiping) in accordance with formal procedures. Media that requires safe disposal must be clearly marked.

Data destroyed in accordance with the process should not be recoverable, even by forensic means.

Connected other frameworks and requirements:
8.3.2: Disposal of media
ISO 27001
11.2.7: Secure disposal or re-use of equipment
ISO 27001
PR.DS-3: Asset management
NIST CSF
PR.IP-6: Data destruction
NIST CSF
A.11.7: Secure disposal of hardcopy materials
ISO 27018
No items found.