An organization lacks a data retention policy. Of the following, who is the BEST person to consult for such requirement?

An Application Manager oversees software application operations and functionality but does not have authority or expertise over legal and regulatory data retention requirements.

A Database Administrator manages the technical storage and performance of databases but is not responsible for defining the compliance-driven policies that determine how long data should be kept.

The Privacy Officer is responsible for ensuring the organization complies with data protection laws and regulations (such as GDPR, HIPAA, or CCPA), which directly dictate how long data must be retained and when it must be destroyed. They have the authority and expertise to define retention schedules based on legal obligations, risk management, and privacy frameworks. This role is specifically chartered to govern data lifecycle policies across the organization.

A Finance Manager may have input on financial record retention for accounting purposes but does not have the broad organizational authority to define a comprehensive data retention policy covering all data types and regulatory requirements.