How to answer 'What is your customer data retention policy upon contract termination?' on a CAIQ
I. Reviewer Guidance & Pitfalls
State the exact grace period (typically 30–60 days to allow customer data export) before irreversible hard deletion across primary databases and backup cycles.
II. Example Answer Passing Enterprise Audit
Compliant Response
Sealed · DSP-07
Upon contract termination, customer data is available for export for 30 days, after which it is permanently purged from primary storage within 30 days and backup archives within 35 days (DPA §8).
Filling out a CAIQ or SIG Lite right now?
QuietQuestionnaire drafts answers with citations pulled directly from your own SOC 2 report, catches contradictions reviewers reject, and locks exports behind cryptographic human sign-off.
No spam · No credit card · Confidential by default