Which of the following is the MOST important consideration when determining retention periods for personal data?

Question

Options

• ASectoral best practices for the industry
• BNotice provided to customers during data collection
• CData classification standards
• DStorage capacity available for retained data

• A
  8% (4)
• B
  73% (35)
• C
  17% (8)
• D
  2% (1)

Explanation

Notice to customers (B) is the most important consideration because retention periods are fundamentally a promise made to individuals at the time of data collection. When organizations inform customers how long their data will be kept, they create a legal and ethical obligation to honor that commitment - violating it breaches the terms under which consent or legitimate interest was established, and triggers regulatory exposure under frameworks like GDPR and CCPA.

Why the distractors fall short:

• A (Sectoral best practices): Industry norms can inform retention policies but don't override the specific notice given to individual data subjects - they're a secondary input, not the primary driver.
• C (Data classification standards): Classification helps determine how data is protected and who can access it, but doesn't dictate how long it must be kept.
• D (Storage capacity): Operational convenience is irrelevant to legal and ethical retention obligations - you can't retain data longer simply because you have disk space, nor delete it early to save storage.

Memory tip: Think of notice as a contract with the customer - you told them "we'll keep your data for X period," so that commitment locks in the retention period above all else. When in doubt, ask: "What did we promise?"

No community discussion yet for this question.