SIG Lite
Control PRI-02
Extractive Review Standard
How to answer 'Do you support the right to erasure (GDPR Art. 17)?' on a SIG Lite
Reviewer Guidance & Pitfalls
If your SOC 2 doesn't cover privacy, do NOT improvise from marketing copy — answer from your DPA/privacy policy and mark the source. State the deletion SLA and what survives in backups (with the backup-expiry bound).
Example Answer Passing Enterprise Audit
Compliant Response Template
Yes. Tenant data is deleted within 30 days of a verified request; residual backup copies expire within the 35-day retention window (DPA §9).
Filling out a CAIQ or SIG Lite right now?
QuietQuestionnaire automatically drafts answers with citations from your own SOC 2 report, catches contradictions reviewers reject, and locks exports behind cryptographic human sign-off.
Zero spam. 100% confidential. No credit card required.