Overview#
Audit trails must be durable, but personal data inside them still has to be governed. A compliance officer should be able to preserve the fact that an action happened while suppressing or erasing personal details that are no longer lawful to retain. Audit PII Retention and Erasure gives organisations that balance: an immutable operational history with controlled handling of personal fields.
The module separates personal data from the durable audit event, applies a governed PII registry, supports retention-driven suppression or deletion, and recomputes integrity evidence so the audit chain remains verifiable after privacy-safe redaction. Companion controls extend the same discipline beyond the audit store: per-organisation retention windows for authentication audit records are actively enforced, and personal data is masked or removed from routine operational logs. It is built for environments where data protection law, health-data regulation, and internal audit requirements overlap.
Key Features#
- PII Side-Record Design: Personal fields are captured automatically at the record layer into a separate erasable store, so the immutable audit event keeps only non-personal content and privacy actions never destroy the evidence that an action occurred.
- Transparent Authorised Read-Back: Audit reads merge the personal data back for authorised viewers, so day-to-day review works as before while the underlying storage stays separable.
- Retention-Driven Erasure: Policies can suppress or physically delete personal fields after the appropriate retention window, or on an erasure request, without touching the append-only log itself.
- Personal Field Registry: Names, contact details, identifiers, and other personal fields are classified so the retention engine knows exactly what can be redacted; the registry has been broadened to cover personal name fields.
- Privacy-Safe Reads: Audit viewers receive a redacted representation when personal fields have expired or when the viewer is not authorised to see them.
- Integrity Preservation: Chain validation recomputes correctly whether or not personal data has been erased, so auditors can distinguish controlled retention actions from tampering.
- Enforced Authentication Audit Retention: Each organisation sets how long authentication audit records are kept, and a scheduled daily purge actively enforces that window, with values clamped to the platform's minimum retention floor of 365 days.
- Email Masking in Audit Metadata: Single sign-on audit entries record masked email addresses, service startup logging redacts administrator addresses, and email delivery logs mask recipient addresses.
- Operational Log Minimisation: Routine operational logs avoid personal data by design: identifiers are hashed or demoted to debug-only visibility, national health identifiers are redacted even in error paths, and search terms are never echoed into logs, with automated regression guards holding the line.
- Failure Visibility: Redaction failures during retention runs are surfaced instead of being silently skipped, so a partial run cannot masquerade as a complete one.
Use Cases#
- GDPR Retention Enforcement: A compliance team keeps security audit evidence for oversight while erasing personal fields that are no longer required for the original purpose.
- Internal Investigation Review: Investigators verify that an event occurred without exposing personal names or identifiers that have expired under policy.
- Data Subject Rights Handling: Privacy teams respond to erasure or access requests with a clear record of which audit fields are personal and how they were handled.
- Long-Term Evidence Retention: Organisations retain tamper-evident operational history without carrying an indefinite personal-data liability.
- Per-Organisation Retention Windows: Deployments serving many organisations apply each organisation's own retention window to personal data while preserving a consistent audit model.
- Log Pipeline Sharing: Operations teams share operational logs with support staff and security monitoring tooling without exposing personal data to everyone with log access.
Integration#
Audit PII retention connects to the platform audit service, privacy registry, data subject rights workflows, compliance reporting, and security monitoring. Because personal fields are captured at the record layer, audit events written across the platform inherit the same privacy controls. Authentication audit records follow each organisation's configured retention window through the daily purge, and retention runs are resilient: a transient storage outage is logged without disrupting other scheduled maintenance. Reports can present the durable event history without exposing suppressed personal fields to unauthorised viewers.
Open Standards#
- GDPR, Regulation (EU) 2016/679: Supports storage limitation, data minimisation, access rights, and erasure obligations while preserving lawful audit evidence.
- ISO/IEC 27701:2019: Aligns personal data handling with privacy information management controls.
- ISO/IEC 27001:2022: Supports logging, monitoring, access control, and records protection controls.
- W3C PROV-DM: Audit records and the retention actions applied to them can be modelled as provenance entities and activities for interchange with provenance-aware tooling.
- RFC 8785, JSON Canonicalisation Scheme: Deterministic serialisation supports reproducible integrity verification for audit evidence.
- FIPS 180-4, SHA-256: Hashing provides tamper evidence for the audit chain.
Last Reviewed: 2026-07-16 Last Updated: 2026-07-16