What is a core principle of a data retention policy?

What is a core principle of a data retention policy?

• A. Keep all data forever
• B. Disregard disposal when storage increases
• C. Retain as required by policy and law; securely dispose when no longer needed
• D. Only exempt encrypted data

Answer: (C)

Data retention policy practice centers on retaining data only as required by policy and law, and securely disposing of it when no longer needed. This approach balances legal compliance with risk management: retention schedules specify how long different data types must be kept, often driven by regulatory or contractual obligations, while secure disposal reduces the chance of sensitive information being exposed once it’s no longer needed. It also supports data minimization and cost control by preventing unnecessary data buildup and the ongoing costs of storing unused information. In practice, this means regularly reviewing stored data, applying appropriate retention periods, and using secure deletion methods when data reaches the end of its life. Keeping everything forever ignores legal requirements and privacy best practices; letting storage growth drive careless disposal misses the need for defined timelines; and focusing only on encrypted data overlooks the requirement to dispose of data securely regardless of its protection state.

Data retention policy practice centers on retaining data only as required by policy and law, and securely disposing of it when no longer needed. This approach balances legal compliance with risk management: retention schedules specify how long different data types must be kept, often driven by regulatory or contractual obligations, while secure disposal reduces the chance of sensitive information being exposed once it’s no longer needed. It also supports data minimization and cost control by preventing unnecessary data buildup and the ongoing costs of storing unused information. In practice, this means regularly reviewing stored data, applying appropriate retention periods, and using secure deletion methods when data reaches the end of its life. Keeping everything forever ignores legal requirements and privacy best practices; letting storage growth drive careless disposal misses the need for defined timelines; and focusing only on encrypted data overlooks the requirement to dispose of data securely regardless of its protection state.