Does your organization have a documented process for securely destroying data according to your retention policy, including maintaining destruction records?

This question assesses whether your organization properly destroys data when it reaches the end of its retention period using appropriate destruction methods, and maintains records of these destructions. Proper data destruction prevents unauthorized access to sensitive information that is no longer needed and demonstrates compliance with data protection regulations like GDPR or CCPA. Evidence could include a documented data destruction procedure, a sample of destruction certificates or logs showing when and how data was destroyed, and records of the destruction method used (e.g., degaussing, shredding, secure wiping with specified tools, or certificates from third-party destruction services).