Disposal of PV data after retention period; must be documented and lawful.
Secure deletion after retention; certificate of destruction.
GDPR, GVP I