[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:iso-27001\u002Fa-8-10":3},{"item":4,"lessons":16,"controls":50,"related":78},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"iso-27001","a-8-10","Annex A 8.10","ISO\u002FIEC 27001:2022 Annex A 8.10: Information deletion",8,"International Organization for Standardization (ISO) and IEC","**What it asks for.** This control expects information stored in information systems, devices or any other storage media to be deleted when no longer required. Its purpose is to avoid unnecessary exposure of sensitive information and to meet legal, regulatory and contractual requirements for deletion.\n\n**In practice.** Good practice means defining retention periods, deleting information when they expire, and using secure deletion methods suited to the media, including verified destruction by service providers. Deletion requirements are agreed with cloud and other suppliers. Auditors look for retention rules, deletion records, certificates of destruction and contract terms covering deletion.\n\n**Common gaps.** Common gaps are keeping everything indefinitely, no deletion in backups or SaaS services and decommissioned devices disposed of without verified wiping. Data held in test environments, exports and personal copies is also frequently forgotten when retention periods end.",null,"https:\u002F\u002Fwww.iso.org\u002Fstandard\u002F27001","See the standard at ISO","2026-10-18T15:18:43.663+00:00",{"total":9,"list":17},[18,22,26,30,34,38,42,46],{"slug":19,"title":20,"published_at":21},"uk-legal-aid-agency-breach-exposes-47-years-of-sensitive-records","UK Legal Aid Agency Breach Exposes 47 Years of Sensitive Records","2026-10-15T16:20:35.876+00:00",{"slug":23,"title":24,"published_at":25},"cjeu-rules-annotation-is-not-erasure-gdpr-applies-to-baptismal-registers","CJEU Rules Annotation Is Not Erasure: GDPR Applies to Baptismal Registers","2026-10-06T16:20:54.673+00:00",{"slug":27,"title":28,"published_at":29},"66m-accounts-exposed-in-times-car-data-breach-including-drivers-license-images","6.6M Accounts Exposed in Times Car Data Breach Including Driver's License Images","2026-10-01T12:21:38.729+00:00",{"slug":31,"title":32,"published_at":33},"cloudflare-container-flaw-exposed-residual-disk-data-across-customers","Cloudflare Container Flaw Exposed Residual Disk Data Across Customers","2026-09-25T08:20:52.099+00:00",{"slug":35,"title":36,"published_at":37},"5320-gdpr-fine-for-unsecured-discarded-employee-documents-in-slovenia","€5,320 GDPR Fine for Unsecured Discarded Employee Documents in Slovenia","2026-09-01T14:20:41.516+00:00",{"slug":39,"title":40,"published_at":41},"pharma-company-fined-for-retaining-influencer-data-beyond-contract-expiry","Pharma Company Fined for Retaining Influencer Data Beyond Contract Expiry","2026-08-26T12:21:22.668+00:00",{"slug":43,"title":44,"published_at":45},"schufas-hidden-shadow-database-exposes-gdpr-retention-failures","SCHUFA's Hidden 'Shadow Database' Exposes GDPR Retention Failures","2026-08-26T08:21:10.263+00:00",{"slug":47,"title":48,"published_at":49},"austrian-court-rules-credit-agencies-must-erase-insolvency-data-after-public-register-removal","Austrian Court Rules Credit Agencies Must Erase Insolvency Data After Public Register Removal","2026-07-09T16:22:00.268+00:00",[51,56,61,65,70,74],{"slug":52,"name":53,"problem":54,"stories":55},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",5,{"slug":57,"name":58,"problem":59,"stories":60},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",2,{"slug":62,"name":63,"problem":64,"stories":60},"immutable-backup","Immutable backup and recovery","Ransomware cannot delete or encrypt your way back.",{"slug":66,"name":67,"problem":68,"stories":69},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",1,{"slug":71,"name":72,"problem":73,"stories":69},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.",{"slug":75,"name":76,"problem":77,"stories":69},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.",[79,84,90,95,100,105,110,114],{"family":80,"item":81,"code":82,"title":83,"together":9},"cis","3","Control 3","Data Protection",{"family":85,"item":86,"code":87,"title":88,"together":89},"gdpr","5","Article 5(1)(f)","Principles relating to processing of personal data",7,{"family":91,"item":92,"code":93,"title":93,"together":94},"itil","overview","ITIL",6,{"family":96,"item":92,"code":97,"title":98,"together":99},"nist-privacy","Privacy Framework","NIST Privacy Framework",4,{"family":85,"item":101,"code":102,"title":103,"together":104},"17","Article 17","Right to erasure ('right to be forgotten')",3,{"family":106,"item":107,"code":108,"title":109,"together":104},"nist-800-53","si-12","SI-12","Information Management and Retention",{"family":85,"item":111,"code":112,"title":113,"together":60},"32","Article 32","Security of processing",{"family":80,"item":115,"code":116,"title":117,"together":60},"8","Control 8","Audit Log Management"]