How long do you keep customer data, and how is it deleted?
A data question from almost every security questionnaire. Here is a model answer, the evidence a reviewer may ask for, and what to say if you don't do this yet.
A model answer
Customer data is kept while the account is active and deleted within [30 days] of the account closing, or sooner on request. Backups containing it roll off within a further [35 days].
Replace the parts in square brackets with what's true for you, and only answer yes to what you do.
Evidence a reviewer may ask for
- Your retention schedule or policy
- The deletion terms in your DPA or customer agreement
If you don't do this yet
If deletion is manual, say so: "Deleted manually on request or at contract end, confirmed in writing." Give the backup period honestly, since backups are what reviewers check next.
Related questions
Is customer data encrypted in transit and at rest?A model answer, the evidence behind it, and what to say if you don't do it yet.Do you enforce multi-factor authentication?A model answer, the evidence behind it, and what to say if you don't do it yet.Security questionnaires without SOC 2How to answer a customer's questionnaire honestly before you have an audit.
Answer it once, on your trust center, for every reviewer.
From £39 a month. No sales call.