A recently issued privacy regulation requires that customer data be deleted within a certain timeframe upon customer request. What is an organization's MOST important consideration related to complian

Question

Options

• AAccess privileges to customer information
• BClassification policies related to customer information
• CKnowing the retention schedule for customer information
• DKnowing the storage location of customer information

• A
  13% (4)
• B
  3% (1)
• C
  7% (2)
• D
  77% (23)

Explanation

You cannot delete data you cannot find. The most critical prerequisite for honoring deletion requests (right to erasure / right to be forgotten) is knowing every location where customer data resides-primary databases, backups, archives, third-party processors, data warehouses, log files, and cached copies. If any location is unknown, the deletion is incomplete and the organization remains non-compliant. Access privileges (A) are necessary to perform the deletion but are secondary to knowing where data is stored. Classification policies (B) help categorize data but do not directly answer where it is stored. Retention schedules (C) govern how long data is kept under normal operations, but do not address locating all copies for deletion upon request-and the regulation's deletion mandate overrides standard retention timelines anyway.

No community discussion yet for this question.