# PI-03 Secure Deletion of Data

- Domain: PI – Portability and Interoperability
- Since C5:2020: changed
- Web page: https://c5.patrickscheid.de/en/pi-03/

## Basic criterion

### PI-03.01B

The cloud service provider's procedures for deleting cloud service customer data, cloud service derived data and account data upon termination of the contractual relationship ensure compliance with the contractual agreements (cf. PI-02). Exceptions are only made if they are required by a valid court order or needed for the fulfilment of known future financial and legal obligations.

**Supplementary information (on 01B, 02B):**

Suitable methods for data deletion are e.g. multiple overwriting or deletion of the encryption key.

### PI-03.02B

The deletion procedures prevent recovery by forensic means that comply with the established rules of technology.

### PI-03.03B

The deletion of the cloud service customer data, cloud service derived data and account data is documented in a manner that enables the cloud service customer to obtain proof of the deletion of its data.

## Complementary customer criteria

Cloud service customers ensure with suitable controls that the legal and regulatory framework (e.g. legal requirements for storage and deletion) is identified and that the deletion of their data is initiated accordingly.

## Changes since C5:2020

From BSI's C5:2026 changelog.

**Basic criterion:**

Specified which data types the criterion applies to.

Included exception case data deletion procedures  if there is a valid court order or known future financial and legal obligations.

Specified the prevention of recovery by forensic means to refer to forensic means that comply with the established rules of technology.

Added requirement regarding the documentation of the deletion.

---

Source: BSI C5:2026, machine-readable edition v1.0.1, © Federal Office for Information Security (BSI) 2026, reproduced unchanged under CC BY-ND 4.0 (https://creativecommons.org/licenses/by-nd/4.0/). Change notes: BSI C5:2026 Changelog, © BSI 2026, CC BY-ND 4.0. Unofficial presentation, not affiliated with BSI.