ISO/IEC DIS 27555
Clause 1 to 4: Scope, references, terms and symbols

ISO/IEC DIS 27555 3: Terms and definitions

What does 3 require?

Ten defined terms carry the method: cluster of PII, data object, deletion, deletion class, deletion rule, deletion period, standard deletion period, regular deletion period, retention period and legal retention period. The draft changes the notes to deletion and moves the detail on mechanisms into clause 5. The vocabulary is where most deletion projects fail quietly. Teams use the word retention for the period a record must be kept and the word deletion for the moment it is removed, then discover that the gap between the two is a process nobody owns. The draft separates them: retention is the time the record must remain available, and the deletion period extends beyond it by at least the time the deletion itself needs. A second common failure is treating a table as a cluster. The draft ties a cluster to a functional purpose, so one customer record can appear in several clusters and one cluster can draw on several systems. A third failure is writing a rule without a starting point. A period of seven years means nothing until the event that starts the clock is named, such as the end of the contract, the last payment or the closure of the case. The DIS also separates the abstract from the specific. A deletion class is a reusable combination of a standard period and an abstract start, while a deletion rule is the specific version for one cluster. That separation is what lets an organisation run a small matrix instead of a rule per record type. The new notes make the definition of deletion less about a single technical act and more about an outcome that can be demonstrated.

Maintained by Gerard Blokdyk

Other controls in Clause 1 to 4: Scope, references, terms and symbols

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.