Retention restriction
When a Purpose’s retention ends, its records stay kept forever and every read of them is restricted.
Satisfies
| Criterion | Text |
|---|---|
| SOC2 C1.2 | The entity disposes of confidential information to meet its confidentiality objectives. |
| SOC2 P4.2 | The entity retains personal information consistent with its objectives. |
| SOC2 P4.3 | The entity securely disposes of personal information consistent with its objectives. |
Implemented by
Test
| Step | Rule |
|---|---|
| Kind | Preventive: it stops the failure before it happens. |
| Select | Every record whose Purpose’s retention ended before or during the report period. |
| Assert | Each carries a read restriction, and no read of it ran after the restriction began. |
Owner
Example
A tutoring marketplace's session notes reach the end of their two-year retention. They stay in the record, and every read of them is now refused.