Define the retention period for collected information in the privacy policy.

CONTROL ID
13116

CONTROL TYPE
Establish/Maintain Documentation

CLASSIFICATION
Preventive

This Control directly supports the implied Control(s):

There are no implementation support Controls.

The period of time during which the personal information is possessed and used, and the procedure and method for destruction of the personal information (including the ground for preservation and items of preserved personal information, if it is required to preserve the personal information in accor… (Article 27-2(2)(3), Act On Promotion of Information and Communications Network Utilization and Information Protection, Amended by Act No. 14080, Mar. 22, 2016)
The period for processing and retaining personal information; (Article 30(1) (2), Personal Information Protection Act)
whether any information collected will be retained by the state agency, and, if so, the period of time that such information will be retained; (§ 203.1(c), New York State Technology Law, Article 2 Internet Security and Privacy Act)