Practice Test GeeksCIPM - Certified Information Privacy Manager Practice Test
← All CIPM Flashcard Decks

Data Retention and Deletion Flashcards

7 cards from real CIPM practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.

Read the first 7 Data Retention and Deletion flashcards as text

  1. What is the primary principle behind data retention schedules in a privacy program?

    Answer: Keeping data only as long as necessary for its specified purpose

    The data minimization and storage limitation principles require that personal data be kept only as long as necessary for the purpose for which it was collected.

  2. Which of the following best describes a data retention schedule?

    Answer: A document mapping data categories to their required retention periods and disposal methods

    A data retention schedule maps each category of data to its mandated or appropriate retention period and the method of secure disposal at end of life.

  3. When establishing retention periods, which factor should take highest priority?

    Answer: Legal and regulatory requirements

    Legal and regulatory requirements set the minimum baseline for retention periods, and failure to comply can result in penalties and liability.

  4. What is a 'legal hold' in the context of data retention?

    Answer: A suspension of normal deletion schedules due to anticipated or ongoing litigation

    A legal hold (or litigation hold) suspends routine data disposal obligations when litigation, investigation, or audit is reasonably anticipated.

  5. Which method is most appropriate for securely disposing of personal data stored on solid-state drives (SSDs)?

    Answer: Cryptographic erasure (destroying the encryption keys)

    SSDs use wear-leveling that makes overwriting unreliable; cryptographic erasure renders data unrecoverable by destroying the keys used to encrypt it.

  6. Under the GDPR's storage limitation principle, personal data should be:

    Answer: Kept in a form that permits identification no longer than necessary

    GDPR Article 5(1)(e) requires that personal data be kept in a form permitting identification of data subjects for no longer than necessary for the stated purpose.

  7. What is 'data minimization' as it relates to retention?

    Answer: Collecting and retaining only the data that is adequate, relevant, and limited to what is necessary

    Data minimization requires that only data that is necessary for the specified purpose be collected and retained, limiting both scope and duration.

How this page was made: written with AI tools and published by Nathan Beja, founder of Practice Test Geeks, who is responsible for its content. Exam facts are checked against the official sources listed below. Not reviewed by a subject-matter expert. Editorial policy

Sources & references

Exam facts on this page (fees, format, dates, passing scores) are checked against these official sources; the date is our last check. Editorial policy

  1. store.iapp.org — Test delivery, fees, exam format · verified Oct 2026
  2. iapp.org — Retake fee · verified Oct 2026
  3. assets.contentstack.io — Renewal, score validity, passing score, retake policy, score release, test dates · verified Oct 2026