NIST CSF 2.0, IdentifyID.AM-08

Take reasonable measures to dispose, or arrange for the disposal, of records containing sensitive personally identifying information within its custody or control once the records are no longer to be retained, by shredding, erasing, or otherwise modifying the information to make it unreadable or undecipherable through any reasonable means consistent with industry standards.

When disposing of records containing personal information, take all reasonable measures necessary to protect against unauthorized access to or use of the records, including burning, pulverizing, or shredding paper documents and destroying or erasing electronic and nonpaper media so the personal information cannot practicably be read or reconstructed.

Adopt written policies and procedures relating to the adequate destruction and proper disposal of records containing personal information.

Redact that personal identifying information, or destroy the paper record or document, before discarding or disposing of it. This duty reaches paper records and documents only; it states no separate duty over electronic data.

Develop a written policy for the destruction or proper disposal of paper and electronic documents containing personal identifying information, and, once those documents are no longer needed, destroy or arrange for their destruction by shredding, erasing, or otherwise modifying the personal identifying information to make it unreadable or indecipherable.

Safeguard the data, computer files and documents containing that personal information from misuse by third parties, and destroy, erase or make them unreadable before disposal.

Take all reasonable measures to dispose, or arrange for the disposal, of customer records containing personal information within your custody or control once the records are no longer to be retained, by shredding, erasing, or otherwise modifying the personal information to make it unreadable or undecipherable through any means.

Shred the record, erase the personal information, modify the record to make the personal information unreadable, or take other action you reasonably believe will ensure that no unauthorized person will have access to the personal information, before discarding or disposing of a customer's record. Personal information here is personally identifiable data about a customer's medical condition, account or credit balance, information supplied on opening an account or applying for credit, or a tax return, combined with an identifier such as a Social Security number, driver identification number, or date of birth.

Take reasonable measures to protect against unauthorized access to or use of personal information in connection with or after its disposal.

Implement and monitor compliance with policies and procedures that require papers containing personal information to be burned, pulverized, recycled, or shredded, and electronic or other nonpaper media containing personal information to be destroyed or erased, so the information cannot practicably be read or reconstructed.

Dispose of paper records containing personal information by redacting, burning, pulverizing, or shredding them, and destroy or erase electronic media containing personal information, so the information cannot practicably be read or reconstructed.

Do not dispose of or abandon records or documents containing unencrypted and unredacted personal information of Indiana residents without shredding, incinerating, mutilating, erasing, or otherwise rendering the information illegible or unusable.

Do not retain identifying information.

Do not retain identifying information after access is granted.

Do not retain a user's identifying information after verification.

Do not retain any identifying information of the individual after access has been granted to the material; this binds a third party that performs the age verification as well.

Do not retain identifying information after verification.

Do not retain identifying information after access is granted.

Do not retain identifying information after access is granted; this binds a third party performing verification as well.

Do not retain identifying information after access is granted.

Do not retain a user's identifying information after access is granted.

Retain seven years of anonymized age verification data.

Do not retain personally identifying information.

As a data-processing service provider acting for another party, use the personal data only for the purpose stated in the service contract, do not disclose it to others, and destroy it once the contracted service ends unless further engagements are reasonably expected, in which case you may keep it securely for up to two years.

Destroy, delete or de-identify a record of personal information as soon as reasonably practicable after you are no longer authorised to retain it, in a manner that prevents its reconstruction.

Destroy personal data as soon as is reasonably practicable once the purpose for storing it has lapsed, in a manner that prevents its reconstruction in an intelligible form, and tell any data processor holding the data to do the same.

Destroy recordings as soon as they are no longer needed for the purpose of the surveillance and at the latest one year after the recording ends, subject to the exceptions in Section 17, paragraph 3 (Section 17, paragraph 3).

Destroy, delete or de-identify a record of personal information as soon as reasonably practicable after you are no longer authorised to retain it, in a manner that prevents its reconstruction.

As a processor handling personal data under contract for a third party, use it only for the purpose the contract states, do not transfer it to anyone else, and delete it once the contract is performed unless the data bank's owner authorized retaining it against a likely further engagement.

Retain personal data only until the purpose of processing is fulfilled unless a listed ground extends retention, and destroy it in a manner that prevents reconstruction once the retention period ends.

Do not keep personal data longer than the purpose requires, and take reasonable steps to destroy or permanently delete it once no longer needed.

Destroy personal data once its declared or authorized retention period expires, its purpose is achieved, or it is no longer useful to your activity, by a bailiff's report made with an INPDP-appointed expert.

Retain personal data no longer than necessary for the purpose collected, and destroy, delete or de-identify it at the expiry of the retention period in a manner that prevents its reconstruction.

Retain covered information only as long as reasonably necessary for the purpose it was collected, and keep a written data retention policy, available on request to a pupil, parent, guardian, education rights holder or K-12 personnel, stating the purposes, the retention purpose and a deletion timeframe (Section 22584(d)(4), (5)).

If you operate a health care facility that further processes health data it stores lawfully under GDPR Article 9(2)(h) or (i) for quality assurance, patient safety, research or statistics, pseudonymize the data, anonymize it as soon as the purpose allows, and delete it no later than 30 years after the further processing began (GDNG Section 6, paragraph 1).

Retain, transfer and dispose of records of personal health information in a secure manner and in accordance with the prescribed requirements.

Provide credit-reference services only as a credit-information company (a Buró de Información Crediticia) authorized by the Banco Central del Paraguay, supply them only to the identified users article 14 lists, keep credit data lawful, accurate, complete and up to date, retain it for no more than five years from the recorded event unless a special rule sets another period or the parties agree a shorter one, and protect it with security measures and a duty of secrecy.

Interrupt, cease or block processing once notified to do so, cooperate with a CNPD request, and erase or destroy personal data once notified or once its retention period under Article 6 has elapsed, on pain of the penalty for qualified disobedience.

Do not retain nominative or encrypted personal data beyond the legal duration stated in the request for opinion or prior declaration for the processing, and do not disclose nominative data in a way that harms the person it concerns.

Do not wilfully collect, use or disclose personal health information in contravention of the Act or its regulations, and do not wilfully dispose of a record in contravention of the secure disposal duty.

Publish a written, publicly available policy establishing a retention schedule, and permanently destroy biometric identifiers and biometric information within 3 years of the individual's last interaction or when the collection purpose is satisfied, whichever occurs first.

Maintain all audit or review workpapers for 5 years from the end of the fiscal period in which the audit or review was concluded (section 1520(a)(1)).

Retain for seven years after you conclude the audit or review (Rule 2-06) the records relevant to it, including workpapers and other documents that form the basis of the audit or review, and the memoranda, correspondence, communications, other documents and records, including electronic records, that you create, send or receive in connection with it and that contain conclusions, opinions, analyses, or financial data related to it.