Data Lifecycle Management Flashcards

Which principle requires that personal data be kept only as long as necessary for its original collection purpose?

Answer: Storage limitation

The storage limitation principle, recognized in GDPR and other frameworks, mandates that personal data must not be retained beyond the period necessary for its specified purpose.

What is the BEST method for ensuring that personal data is irreversibly destroyed at the end of its retention period?

Answer: Overwriting data with random bits multiple times

Cryptographic erasure or multi-pass overwriting renders data unrecoverable, meeting the standard for irreversible destruction under data protection regulations.

A CDPSE candidate is designing a data retention schedule. Which factor is MOST critical to determine first?

Answer: Legal and regulatory retention requirements

Legal and regulatory requirements set the minimum and maximum retention periods that override business convenience or cost considerations.

During which data lifecycle phase is the Privacy Impact Assessment (PIA) MOST effectively initiated?

Answer: Data collection phase

Initiating a PIA during the data collection design phase allows privacy risks to be mitigated before personal data is ever gathered.

Which data lifecycle stage presents the HIGHEST risk of unauthorized re-identification?

Answer: Data disposal

Improper disposal—such as discarding unwiped storage media—can expose de-identified or supposedly deleted personal data to re-identification by unauthorized parties.

What is 'data mapping' in the context of the personal data lifecycle?

Answer: Documenting where personal data originates, moves, and is stored across the organization

Data mapping creates a comprehensive inventory of personal data flows, which is foundational to demonstrating compliance and identifying privacy risks.