SOC 2 C1.2: confidential data disposal, explained for startups

What usually proves it

An auditor wants records from the period being examined, pulled from the systems that hold them rather than written up afterwards. Dates matter. A record with a date and a named owner carries more weight than a screenshot with neither. For C1.2, the usual records are these.

• A retention schedule
• Deletion logs or certificates of destruction
• Customer offboarding records showing data deleted

What Polara asks about it

The free readiness assessment asks 2 questions that bear on C1.2. A yes becomes a task to show the proof. A no becomes a task to fix the gap, with the steps written out.

• Have you set how long each kind of confidential information is kept, and is it protected from deletion before then? If yes, show it: retention schedule listing each kind of confidential information and its period, a storage lifecycle rule, or a contract clause naming the retention period. If no, the fix: write a retention schedule that names each kind of confidential information, its retention period and its owner.
• When confidential information reaches the end of its retention period, is it destroyed and the destruction recorded? If yes, show it: signed destruction log entry, a vendor deletion certificate, a lifecycle deletion job report, or a device wipe record. If no, the fix: destroy confidential information when its retention period ends, including copies in backups and vendor systems, and keep a signed destruction log.

Policies, templates and connected evidence

A policy states the rule, a template gives you the record to keep, and a connected system pulls the proof from the source. An auditor checks that the three agree: the cadence in the policy, the dates in the record and what the system shows.

In the policy pack, the Confidentiality Policy covers C1.2.

If you also run ISO 27001, the Annex A control A.8.10, deleting information ask for overlapping evidence. One record can serve both when it names what it proves.

Is it in your scope?

Only if you add Confidentiality. How you identify and protect information you have agreed to keep confidential, and how you destroy it when the time comes. It fits a company whose contracts carry confidentiality obligations.

The scoping tool decides it with one question: Add it when contracts or non-disclosure agreements commit you to keep customer or partner information confidential. Identifying and labelling confidential information, limiting access to it, keeping it for a set period and destroying it with a record.

Security is the default and always in scope. Adding Confidentiality in the assessment puts its 2 criteria into the report and the examination, and adds 5 questions to the assessment.

Polara Labs is not a CPA firm. SOC 2 examinations are performed by independent licensed U.S. CPA firms.

Confidentiality: the criteria around it

C1.2 is one of 2 criteria in confidentiality, C1.1 to C1.2. Reading a group together shows how its outcomes fit, and one record often serves more than one of them.

• C1.1, confidential data handling
• C1.2, this page

Before it: C1.1, confidential data handling. After it: PI1.1, processing specifications. All the criteria, Security first, are on the Trust Services Criteria page, grouped by category.