Controls

Terug naar overzicht
Version

SB.6.012 Retention periods

Data Protection
Low
Low
nvt
Process Owner
v2.0 (Q1 2024)

Description

How long data is retained and available is identified and recorded and adheres to the minimum legal or business requirements. After this period, data is deleted and unrecoverable.

This includes sensitive data stored on hardcopy which needs to be properly shredded and destroyed.

Specification

In the education sector, there are a few products that specify minimum requirements, such as:

For universities/universiteiten, there is the 'Selectielijst Universiteiten en Universitair Medische Centra'. For universities of applied sciences/hogescholen, there is the 'Selectielijst hogescholen'. Within the MBO, a selection list: Documentair Structuur Plan MBO Raad.