Decide whether personal information the business no longer needs should be deleted or disposed of
Key facts
- Human involvement
- YellowClose supervision
- How AI is used
- List each category still held, the purpose on the collection notice, and whether that purpose has ended. Separate a consumer's deletion request from the business's own retention decision.
- What the lawyer must review
- The California Privacy Protection Agency's FAQ requires a covered business to limit retention, as well as collection and use, to the purposes it describes, and only to what is reasonably necessary and proportionate. A California resident can also request deletion of personal information the business collected from them, and the business must tell its service providers to delete, subject to exceptions such as a legal duty to keep the information. The FTC Start with Security guide says a business should know what personal information it stores, keep only what is essential, protect what it keeps, and properly dispose of what it no longer needs. These pages do not describe an Australian-style de-identification alternative that replaces deletion.
- Written for / version
- United States versionUS
Who does what
| Role | What they do |
|---|---|
| Assistance | Consider narrowly defined preparation support after confirming the tool’s capability and permitted scope. |
| Lawyer | Set the scope, supervise the work closely, verify every part relied on, resolve omissions and exceptions, and approve the exact output. |
Checklist
- Confirm that the actual tool, feature and processing terms permit use of this information, including access, retention, training and disclosure conditions.
- Confirm the output against the client’s instructions and the complete relevant source material, including omissions or contradictions.
- Resolve exceptions and record the responsible lawyer’s approval of the exact output and intended use.