ISO 27701 clause 8.4 ensures that an organisation’s PII collecting and processing operations limit efforts to the minimum that’s required, in order to achieve a set of identified purposes.
Organisations need to ensure that temporary files are destroyed within a reasonable amount of time, in accordance with an official retention policy and clear deletion procedures.
A simple way to identify the existence of such files is to perform periodic checks of temporary files across the network.
Organisations should adhere to a so-called garbage collection procedure that deletes temporary files when they’re no longer needed.
Organisations need to have concrete plans in place that govern how PII can be returned, transferred or disposed of, and make all such policies available to the customer.
There are various scenarios that require the disposal of PII, including (but not limited to):
Organisations need to provide categorical assurances that any PII which is no longer needed is going to be destroyed in accordance with any prevailing legislation or regional guidelines.
All disposal policies should be available to the customer on demand, and should cover the period of time that organisations have to destroy PII, once a contract has been terminated.
Whenever the need arises for PII to be transmitted over a data network (including a dedicated link), organisations need to be preoccupied with ensuring that the PII reaches the correct recipients, in a timely manner.
When transferring PII between data networks, organisations should:
Various elements of ISO 27701 Clause 8.4 are applicable within UK GDPR legislation. Take a look at the below table for the corresponding references.
| ISO 27701 Clause Identifier | ISO 27701 Clause Name | Associated GDPR Articles |
|---|---|---|
| 8.4.1 | Temporary Files | Article (5) |
| 8.4.2 | Return, Transfer or Disposal of PII | Articles (28), (30) |
| 8.4.3 | PII Transmission Controls | Article (5) |
The ISMS.online platform offers integrated assistance at every stage, and our ‘Adopt, Adapt, Add’ implementation approach to ISO 27701, to make the process much easier. You will also benefit from a variety of time-saving features.
We’ve created a built-in risk bank and a range of other practical tools that’ll help with every part of the risk assessment and management process.
You’ll be ready when the worst happens. We make it easy to plan and communicate your breach workflow, and document and learn from each and every incident.
Find out more by booking a demo.
Book a tailored hands-on session
based on your needs and goals
Book your demo
