Long format clause

The current draft of the Ministry of Justice (MoJ) commodity long format data destruction clause.

Highlighted words indicate potential requirement for contextual change, requirement of definition and so on.

Clause

1. Data Destruction

   1. The Authority requires the Supplier to ensure that Data Destruction has been adequately completed at the natural end and/or termination of contract as per Schedule XX.

   2. The Supplier shall take all reasonable commercial measures to ensure Data Destruction is an irrevocable action to prevent the reconstitution of data, in alignment with methods described in Appendix XX.

   3. The Supplier shall notify the Authority when data destruction has taken place, including the final date by which such destruction shall be complete in the case of scheduled data destruction or natural data management lifecycles such as through automated backup or disaster recovery systems.

   4. Where data cannot be immediately destroyed, access control methods must be put in place to limit the ability the ability for Data Processing until data destruction can be completed.

   5. The Supplier shall provide evidence of data destruction on request from the Authority, including but not limited to, copies of third-party data destruction certificates, copies of internal policy and process documents in relation to data management and data destruction.

   6. The Supplier shall notify the Authority within 24 (twenty-four) hours of identification of unsuccessful or incomplete data destruction.

Feedback

If you have any questions or comments about this guidance, such as suggestions for improvements, please contact: itpolicycontent@digital.justice.gov.uk.