PI-03 Secure Deletion of Data

The cloud service provider's procedures for deleting cloud service customer data, cloud service derived data and account data upon termination of the contractual relationship ensure compliance with the contractual agreements (cf. PI-02). Exceptions are only made if they are required by a valid court order or needed for the fulfilment of known future financial and legal obligations.

Supplementary information

Suitable methods for data deletion are e.g. multiple overwriting or deletion of the encryption key.

The deletion procedures prevent recovery by forensic means that comply with the established rules of technology.

Supplementary information

Suitable methods for data deletion are e.g. multiple overwriting or deletion of the encryption key.

The deletion of the cloud service customer data, cloud service derived data and account data is documented in a manner that enables the cloud service customer to obtain proof of the deletion of its data.

Cloud service customers ensure with suitable controls that the legal and regulatory framework (e.g. legal requirements for storage and deletion) is identified and that the deletion of their data is initiated accordingly.