We are all guilty of being digital hoarders. Whether it is that “draft_v1_final_REAL.docx” from three years ago or a customer database from a project that ended in 2019, we tend to keep data “just in case.” But in the world of information security, holding onto data you don’t need isn’t just clutter—it’s a liability.
This is exactly why ISO 27001:2022 Annex A 8.10 was introduced. This control, titled “Information Deletion,” is one of the new additions to the 2022 standard. It shifts the mindset from just protecting data to knowing when to destroy it. Let’s break down exactly how to implement this control effectively without getting bogged down in technical jargon.
Table of contents
What is Annex A 8.10?
In simple terms, Annex A 8.10 requires that information stored in information systems, devices, or any other storage media is deleted when it is no longer required. It falls under the “Technological Controls” category, but as with most ISO controls, it requires a mix of technology, policy, and process.
The goal is to prevent the unnecessary exposure of sensitive information. If you don’t have the data, it can’t be stolen, leaked, or ransomed. It also ensures you are complying with privacy laws like GDPR, which mandate that you shouldn’t hold personal data longer than necessary.
Why “Right-Click Delete” Isn’t Enough
One of the biggest misconceptions is that hitting the “delete” key makes data disappear. In reality, most operating systems simply hide the file and mark the space as “available” for new data. Until that space is overwritten, the original data is easily recoverable with basic free software.
To comply with Annex A 8.10, you need secure deletion. This means the data is rendered irretrievable.
Step 1: Set the Rules (The Policy)
You can’t expect your team to know when to delete files if you haven’t told them the rules. This control is heavily dependent on your Data Retention Policy.
Your policy needs to answer:
- What needs to be kept? (e.g., tax records for 7 years).
- When does it expire? (e.g., CVs of unsuccessful candidates after 6 months).
- How is it destroyed? (e.g., secure erasure vs. physical shredding).
If you don’t have these policies in place, you are already on the back foot. Hightable.io provides excellent ISO 27001 toolkits that include robust templates for Data Retention and Information Classification policies, which can save you days of drafting time.
Step 2: Choose Your Deletion Methods
Once you know what to delete, you need to decide how. The method should match the sensitivity of the data.
1. Secure Overwriting (Software)
For hard drives and servers that you intend to keep using, you need software that overwrites the data multiple times with random 1s and 0s. This is often called “wiping” or “shredding” files digitally.
2. Physical Destruction (Hardware)
If a laptop or hard drive has reached the end of its life, don’t just throw it in the bin. You need to physically destroy the storage media. This could involve:
- Shredding: Putting the hard drive through an industrial shredder.
- Degaussing: Using powerful magnets to scramble magnetic media (like tapes or HDDs).
- Disintegration: Grinding the device into dust (common for SSDs).
3. Cryptographic Erasure
For cloud storage or mobile devices, overwriting isn’t always possible. Instead, you encrypt the data and then securely destroy the encryption key. Without the key, the data is just useless noise. This is how “Factory Reset” works on most modern smartphones.
Step 3: Don’t Forget the Hidden Data
A common audit trap is to focus only on the live database and forget where else that data lives. To fully implement Annex A 8.10, you must consider:
- Backups: If you delete a customer from your CRM but keep their details in a backup for 10 years, have you really deleted them? Ensure your backup retention aligns with your deletion policy.
- Third-Party Vendors: If you use a SaaS provider, how do they handle deletion? Do they guarantee your data is gone when you cancel your contract?
- Temporary Files: Check for “Downloads” folders, cache files, and temporary exports that users often create and forget.
Step 4: Prove It (Verification and Evidence)
In ISO 27001, if you didn’t document it, it didn’t happen. An auditor will ask for evidence that deletion has occurred.
For in-house deletion: Keep logs of automated deletion scripts or software wiping reports.
For third-party disposal: If you hire a company to shred your old hard drives, get a Certificate of Destruction. This is your “Get Out of Jail Free” card if that drive ever shows up on eBay.
DO IT YOURSELF
STOP SPANKING £10,000s on CONSULTANTS and ISMS ONLINE PLATFORMS
Common Pitfalls to Avoid
- The “Format” Mistake: Formatting a drive does not erase the data; it just resets the file system. Always use secure wiping tools.
- Donating without Wiping: Giving old laptops to charity is a noble cause, but if they still contain company data, it’s a data breach waiting to happen. Wipe them first.
- Cloud “Trash” Folders: Deleting a file in Cloud Storage often moves it to a “Deleted Items” recovery bin for 30-90 days. Be aware of this delay.
Conclusion
Implementing ISO 27001 Annex A 8.10 is about cleaning up your digital house. It reduces your storage costs, speeds up your systems, and significantly lowers your risk profile. By combining a strong policy (like those from Hightable.io) with the right technical tools, you can turn data deletion from a chore into a strategic advantage.
About the author
Stuart Barker is a veteran practitioner with over 30 years of experience in systems security and risk management.
Holding an MSc in Software and Systems Security, Stuart combines academic rigor with extensive operational experience. His background includes over a decade leading Data Governance for General Electric (GE) across Europe, as well as founding and exiting a successful cyber security consultancy.
As a qualified ISO 27001 Lead Auditor and Lead Implementer, Stuart possesses distinct insight into the specific evidence standards required by certification bodies. He has successfully guided hundreds of organizations – from high-growth technology startups to enterprise financial institutions – through the audit lifecycle.
His toolkits represents the distillation of that field experience into a standardised framework. They move beyond theoretical compliance, providing a pragmatic, auditor-verified methodology designed to satisfy ISO/IEC 27001:2022 while minimising operational friction.
