NIST Privacy Framework, Control-PCT.DM-P5

Do not keep personal data longer than necessary for the purpose it was collected for, and destroy or permanently delete it once that purpose has lapsed.

As a military, security, police, or intelligence body, limit consent-free processing of personal data for defense or public-security purposes to what your legally assigned mission strictly requires, keep the resulting files specific and classified by reliability, and cancel police-purpose data once it is no longer needed for the inquiry that justified it.

As a data-processing service provider acting for another party, use the personal data only for the purpose stated in the service contract, do not disclose it to others, and destroy it once the contracted service ends unless further engagements are reasonably expected, in which case you may keep it securely for up to two years.

Delete personal data once processing ends, unless retention is needed to comply with a legal or regulatory obligation, for research with anonymization where possible, for an authorized transfer, or for your own exclusive anonymized use.

Delete Personal Data once the purpose it was collected for is satisfied, or hold it in a form that does not allow the Data Subject to be identified, and correct any error immediately on being told of it or becoming aware of it.

Destroy, delete or de-identify a record of personal information as soon as reasonably practicable after you are no longer authorised to retain it, in a manner that prevents its reconstruction.

Destroy personal data as soon as is reasonably practicable once the purpose for storing it has lapsed, in a manner that prevents its reconstruction in an intelligible form, and tell any data processor holding the data to do the same.

Destroy, delete or de-identify a record of personal information as soon as reasonably practicable after you are no longer authorised to retain it, in a manner that prevents its reconstruction.

Delete personal data relating to a contractual default once seventy-two months have passed from the date the default occurred, and otherwise suppress personal data, after any blocking period, once it is no longer necessary for the purposes stated in the privacy notice.

Get the Minister of State's prior authorisation before installing a video surveillance system in a place open to the public or filming a public way, and do not keep recorded images for more than 30 days.

Where you run video surveillance of business or official premises, display a public notice of it, avoid recording residential interiors or apartment entrances, and store the recordings for no longer than one year, under Articles 35 to 40.

An app that captures or stores a facial image, voiceprint (sound fragment and its acoustic parameters in the Act's own term), or other biometric identifier from a person in Azerbaijan is still bound by this Act's ordinary processing conditions, a lawful basis under Art. 9.6 and destruction under Art. 9.4 once the purpose is achieved, even though Azerbaijan does not treat biometric data as a heightened special category and imposes no biometric-specific consent, retention, or storage-technology duty.

Publish a written, publicly available policy establishing a retention schedule, and permanently destroy biometric identifiers and biometric information within 3 years of the individual's last interaction or when the collection purpose is satisfied, whichever occurs first.

Obtain written consent before processing a person's biometric data in Russia, never condition service on that consent, and retain any biometric sample your organization holds only up to 10 days before deleting it, since the durable copy of record lives in the state system.

Store and transmit a captured biometric identifier with reasonable care equal to or exceeding the protection given your other confidential information, and destroy it within a reasonable time, no later than the first anniversary of when the collection purpose expires.

Inform both parties of a call or communication recording, its precise purposes, and its storage period before recording it for proof of a commercial transaction with a person in Belgium, and erase the data once the transaction can no longer be challenged in court.

Limit a call-centre quality-monitoring recording to a maximum one-month retention, with prior information to staff, under Act Article 10/1 paragraph 2.

An app that processes biometric data about an individual in Jordan, including a faceprint or voiceprint, must treat it as Sensitive Personal Data and obtain consent or rely on one of the Law's enumerated exceptions, and must not retain it beyond the processing purpose unless legislation specifies otherwise. Whether Jordan requires a heightened, explicit-consent standard specifically for biometric processing, beyond ordinary consent, is not confirmed.

An app that derives a faceprint, voiceprint, or other identity-linked biometric identifier from an individual in Saudi Arabia, for any purpose the purpose-based Sensitive Data definition would reach, must obtain the Data Subject's explicit consent before processing it, and must destroy it once the processing purpose is fulfilled or consent is withdrawn.

Honor a consumer's revocation of consent and destroy their biological sample within 30 days.

Interrupt, cease or block processing once notified to do so, cooperate with a CNPD request, and destroy personal data once its retention period under article 6 has elapsed, on pain of the penalty for qualified non-compliance.

Do not retain nominative or encrypted personal data beyond the legal duration stated in the request for opinion or prior declaration for the processing, and do not disclose nominative data in a way that harms the person it concerns.

If your business monitors or records employees' marketing, opinion research or telephone solicitation calls (including order-taking, customer assistance and credit collection calls) under the one-party exemption, use it only for service quality control, training or internal research, never furnish or divulge the recordings to law enforcement or any third party, stop and destroy any recording of an unrelated call, give employees notice including prominent workplace signage, and provide personal-only lines that are not monitored.

If you record telephone marketing or customer service communications for training, quality control or monitoring, have one party's consent, use the recordings only for training or quality control, and destroy them within one year unless federal or State law requires otherwise.

On a data subject's request, suppress and cancel their personal data from a social network, browser, or server, and, once your contractual relationship with them ends, suppress and cancel the personal data you collected during it.