How to answer 'Do you support the right to erasure (GDPR Art. 17)?' on a SIG Lite
I. Reviewer Guidance & Pitfalls
If your SOC 2 doesn't cover privacy, do NOT improvise from marketing copy — answer from your DPA/privacy policy and mark the source. State the deletion SLA and what survives in backups (with the backup-expiry bound).
II. Example Answer Passing Enterprise Audit
Compliant Response
Sealed · PRI-02
Yes. Tenant data is deleted within 30 days of a verified request; residual backup copies expire within the 35-day retention window (DPA §9).
Filling out a CAIQ or SIG Lite right now?
QuietQuestionnaire drafts answers with citations pulled directly from your own SOC 2 report, catches contradictions reviewers reject, and locks exports behind cryptographic human sign-off.
No spam · No credit card · Confidential by default