Control: the processor has a policy on returning, transferring and disposing of PII and makes it available to the customer. Guidance: disposal can mean returning PII to the customer, transferring it to another processor or a controller (for example after a merger), deleting or destroying it securely, anonymising it or archiving it. The processor gives the information the customer needs to make sure PII is erased by the processor and its sub-contractors wherever held, backups and continuity copies included, once no longer needed for the customer's purposes; the disposal methods (de-linking, overwriting, demagnetisation, destruction or other erasure) or commercial standards are fixed in the contract. The policy states how long PII is kept after the contract ends before it is destroyed, so an accidental lapse of the contract does not cost the customer its data. Note: this also serves the retention element of A.6.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.