Today's wrinkle continues the example with the bakery as the consumer facing protagonist – the company collecting consumer data and licensing software to process it.
How is Time Triggered?
Two things you disclosed to the consumer: how long you keep their personal information, and that they can ask you to delete it. The trouble is your vendor is holding a copy of that same data on its own clock. This is a less frequently negotiated provision than it should be… But as a practice tip, the vendor's clock has to run shorter than yours, or you can't actually deliver the deletion you promised.
What does this mean in practice?
1. The first move is mechanical: the vendor's retention period must be less than or equal to your disclosed period. If the vendor keeps the data longer, your privacy notice is a promise you can't keep.
2. Then there's the trap that bites at the end of the relationship.
Plenty of software agreements flip the deletion obligation onto you. The vendor will destroy your data, but only after you tell them to do it. Read that clause and you'll see the failure mode: it's an operational violation waiting to happen. The contract permits deletion; nothing guarantees anyone executes it. Who is going to remember during the transition from one accounting software to another once onboarding is completed that you have to tell the prior vendor in writing to delete all confidential data and get confirmation? Termination happens, everyone moves on, the destroy-notice never goes out … and now the vendor is sitting on consumer data past the retention window you disclosed. You're in breach of your own privacy notice, and you did it by inaction.
The Fix?
1. Fight for automatic deletion. Or…
2. Treat post-termination deletion as a step that runs near automatically, not a right that sits in a contract. Appoint someone with the obligation to track all such obligations with respect to contracts. Calendar the destroy-notice. Confirm the vendor executed it. Close the loop.
Wrinkle 003 next: do you have a working data mapping/processing system?
