CAIQ v4
Control DSP-07
Extractive Review Standard
How to answer 'What is your customer data retention policy upon contract termination?' on a CAIQ
Reviewer Guidance & Pitfalls
State the exact grace period (typically 30–60 days to allow customer data export) before irreversible hard deletion across primary databases and backup cycles.
Example Answer Passing Enterprise Audit
Compliant Response Template
Upon contract termination, customer data is available for export for 30 days, after which it is permanently purged from primary storage within 30 days and backup archives within 35 days (DPA §8).
Filling out a CAIQ or SIG Lite right now?
QuietQuestionnaire automatically drafts answers with citations from your own SOC 2 report, catches contradictions reviewers reject, and locks exports behind cryptographic human sign-off.
Zero spam. 100% confidential. No credit card required.