Disposal of Stored Data Clause Samples
Disposal of Stored Data. All data must be securely disposed of when no longer required by Stockport School, regardless of the media or application type on which it is stored. • An automatic process must exist to permanently delete on-line data, when no longer required. • All hard copies of cardholder data must be manually destroyed when no longer required for valid and justified business reasons. A quarterly process must be in place to confirm that all non-electronic cardholder data has been appropriately disposed of in a timely manner. • Stockport School will have procedures for the destruction of hardcopy (paper) materials. These will require that all hardcopy materials are crosscut shredded, incinerated or pulped so they cannot be reconstructed. • Stockport School will have documented procedures for the destruction of electronic media. These will require: o All cardholder data on electronic media must be rendered unrecoverable when deleted e.g. through degaussing or electronically wiped using military grade secure deletion processes or the physical destruction of the media; o If secure wipe programs are used, the process must define the industry accepted standards followed for secure deletion. • All cardholder information awaiting destruction must be held in lockable storage containers clearly marked “To Be Shredded” - access to these containers must be restricted.
Disposal of Stored Data. All data must be securely disposed of when no longer required by the trust, regardless of the media or application type on which it is stored. An automatic process must exist to permanently delete on-line data, when no longer required. All hard copies of cardholder data must be manually destroyed when no longer required for valid and justified business reasons. A quarterly process must be in place to confirm that all non-electronic cardholder data has been appropriately disposed of in a timely manner. The trust will have procedures for the destruction of hardcopy (paper) materials. These will require that all hardcopy materials are crosscut shredded, incinerated or pulped so they cannot be reconstructed. The trust will have documented procedures for the destruction of electronic media. These will require: o All cardholder data on electronic media must be rendered unrecoverable when deleted e.g. through degaussing or electronically wiped using military grade secure deletion processes or the physical destruction of the media; o If secure wipe programs are used, the process must define the industry accepted standards followed for secure deletion. All cardholder information awaiting destruction must be held in lockable storage containers clearly marked “To Be Shredded” - access to these containers must be restricted. The policies and procedures outlined below must be incorporated into company practice to maintain a high level of security awareness. The protection of sensitive data demands regular training of all employees and contractors. Review handling procedures for sensitive information and hold periodic security Approved by the Board of Trustees on 20th March 2023 To be reviewed annually. awareness meetings to incorporate these procedures into day to day company practice. Distribute this security policy document to all company employees to read. It is required that all employees confirm that they understand the content of this security policy document by signing an acknowledgement form (see Appendix A). All employees that handle sensitive information will undergo background checks (such as criminal and credit record checks, within the limits of the local law) before they commence their employment with the trust. All third parties with access to credit card account numbers are contractually obligated to comply with card association security standards (PCI/DSS). Company security policies must be reviewed annually and updated as needed.