Overview#
Security teams need immutable audit trails, but privacy teams need personal data to expire, be minimised, or be erased when retention rules require it. The Audit PII Retention and Erasure module separates personal audit details from the durable audit event so organisations can preserve accountability without retaining unnecessary personal data forever.
Audit records remain useful for chain-of-custody, compliance reporting, and tamper-evidence even when personal fields have been removed from the PII side record. Retention jobs can erase personal values, recompute integrity material where required, and keep a visible record that the audit event still exists but no longer carries the personal detail.
Key Features#
-
Side-Record PII Separation: Personal fields are stored separately from the core audit event so retention policy can act on sensitive values without deleting the existence of the action.
-
Durable Non-PII Events: Event type, tenant, resource category, timestamp, and integrity metadata remain available for accountability even after personal details are erased.
-
Policy-Driven Erasure: Retention rules can remove personal audit fields when legal, contractual, or organisational retention periods expire.
-
Integrity Reconciliation: Audit verification can account for erased side records while preserving evidence that the original event sequence has not been altered.
-
Database-Level Capture: Low-level capture paths protect against missed audit writes by recording relevant actions close to the persistence boundary.
-
Visible Erasure State: Reports distinguish between never-collected data, retained personal details, and details that were intentionally erased by policy.
-
Failure Surfacing: Retention and recomputation failures are reported as operational compliance events rather than silently weakening the audit trail.
Use Cases#
- Right-to-erasure handling where personal audit details must be removed but the organisation still needs to prove that governed actions occurred.
- Long-retention evidence systems where chain-of-custody events outlive the permitted retention period for some personal metadata.
- Privacy-by-design auditing where default audit records minimise personal data while preserving compliance evidence.
- Regulated investigations where disclosure teams need to explain why a historical audit event remains visible with personal detail removed.
- Internal access review where security teams can validate event completeness without broadly exposing staff or subject identifiers.
Integration#
The module connects audit capture, retention policy, compliance reporting, evidence access logging, and tamper-evident verification. Personal audit details are treated as governed data with their own retention lifecycle, while non-PII event records continue to support system accountability and investigation integrity.
Open Standards#
- GDPR (EU Regulation 2016/679): Data minimisation, storage limitation, accountability, and erasure principles are reflected in separated personal audit details and policy-driven retention.
- ISO 15489 Records Management: Audit events and erasure markers support controlled retention, disposition, and records accountability.
- ISO/IEC 27001:2022: Logging, monitoring, access control, and information lifecycle controls align with Annex A governance requirements.
- NIST SP 800-53 AU Controls: Audit generation, review, retention, protection, and reduction map to the NIST audit and accountability control family.
- Common Event Format (CEF): Security event exports can preserve standard event structure while omitting or masking erased personal values.
- SHA-256 (FIPS 180-4): Audit chain verification uses a standard cryptographic hash function for tamper-evidence and integrity reconciliation.
- ISO 8601: Event, retention, erasure, and verification timestamps use consistent date and time formatting.
- W3C PROV-DM: Erasure, recomputation, and reporting actions can be represented as provenance events for defensible audit history.
Security and Compliance#
Erasure does not mean silent deletion of accountability. The module preserves the governed event, records the retention action, protects chain integrity, and prevents personal details from remaining available past policy. Access to retained personal audit details remains role-limited and logged.
Last Reviewed: 2026-06-25 Last Updated: 2026-06-25