Why it matters
Data kept past its useful or legally required life is pure liability with no upside.
How a self-led small team implements it
Automated deletion rules tied to your retention schedule (A.5.33) close the loop between policy and practice.
What auditors expect to see
Deletion policy, automated retention rules.
Track A.8.10 in your own Statement of Applicability — mark it applicable, log your justification, and link it to the risk that drove it.
Start your ISMS