When contracting with a SaaS provider, it is important to ensure that the provider will remove all customer data from their systems and storage devices at the end of the service contract. This will prevent any unauthorized access, use, or disclosure of the customer data by the provider or third parties after the service termination. Removal of customer data means that the data are permanently erased and cannot be recovered or restored by any means.
[References:, ISACA, Data Privacy Audit/Assurance Program, Control Objective 9: Data Disposal, p. 16-171, ISACA, CDPSE Review Manual 2021, Chapter 4: Privacy Incident Response, Section 4.2: Data Disposal and Destruction, p. 151-152., ]
Submit