SFS 4 / SF 8

Back to SFS 4

Status: Question model review passed; solution and completed SF authoring pending.

This is a generated authoring draft. Human approval and operational assessment results have not been supplied.

Question

Are data minimization principles consistently applied to organization-owned information throughout the review period to ensure only necessary data is collected and retained?

Plain-language explanation

Model-reviewed question draft. Completed explanations and a canonical solution are pending. The proposed positive criterion is: Documented evidence shows data collection/retention aligns with defined business purposes and minimum required data sets

Assessment criterion and evidence

Actor: Organization. Scope: All data processing activities involving organization-owned information across local, network-attached, and cloud storage systems. Evidence period: Review period. Required evidence: Documented data minimization policy specifying retention criteria; System configurations enforcing data collection limits; Audit records validating adherence to retention schedules. Negative criterion: Evidence shows systematic collection or retention of data beyond documented operational needs or stated purposes. Missing evidence: No documented policies, system configurations, or audit records demonstrating adherence to data minimization principles

View the JSON record (opens in a new tab).

Assessment result: unset.