Question

A retailer terminates a contract with a cloud-based marketing analytics processor that held several million customer records. The contract requires the processor to destroy all personal data upon termination. As the data privacy solutions engineer, what is the MOST important action to ensure the disposal obligation is actually met?

Accepted Answer

Obtain a certificate of destruction and evidence covering all data locations, including backups and replicas, and verify it against the data flow inventory

Answer

Rely on the standard contractual destruction clause, since the processor is legally bound to comply

Answer

Request that the processor return all records to the retailer before deleting its own copies

Answer

Immediately revoke the processor's API credentials and consider the data disposed