Data Retention and Deletion Flashcards

When personal data is collected for research purposes under GDPR, what special retention provision applies?

Answer: Data may be kept longer than the original purpose would allow, provided appropriate safeguards such as pseudonymization are in place

GDPR Article 89 permits derogations to the storage limitation for research purposes when appropriate safeguards like pseudonymization protect data subject rights.

Which of the following best describes 'anonymization' in the context of data retention?

Answer: Irreversibly processing data so it can no longer be related to an identified or identifiable individual

True anonymization irreversibly prevents re-identification; once genuinely anonymized, data falls outside the scope of privacy regulations and retention rules for personal data.

An organization's HR department wants to retain employee performance reviews indefinitely for historical benchmarking. What should the privacy officer advise?

Answer: Deny the request and establish a defined retention period tied to a legitimate purpose, with a disposal process

Storage limitation principles prohibit indefinite retention of personal data; the privacy officer should work with HR to define a purpose-based retention period and secure disposal process.

What is the recommended approach when a data subject submits a right-to-erasure request for data that is subject to a legal retention requirement?

Answer: Deny the erasure request and document the legal retention obligation that overrides it

When a legal retention obligation exists, it constitutes grounds to refuse erasure; the organization should document this reason and communicate it to the data subject.

Which of the following is NOT a recognized secure method of destroying paper records containing personal data?

Answer: Placing documents in a recycling bin without prior shredding

Placing documents in an open recycling bin without shredding does not constitute secure destruction, as the data remains readable and accessible.

How should retention rules be applied to data collected through a mobile application?

Answer: The same retention schedule that governs the underlying data categories applies, regardless of collection channel

Retention obligations attach to the data category and purpose, not the collection channel; mobile app data must follow the same schedule as equivalent data collected through other means.

Which of the following metrics would best demonstrate the effectiveness of a data retention program to senior management?

Answer: Percentage of data categories covered by an approved retention schedule and rate of on-time disposal

Coverage of data categories by retention schedules and compliance with disposal timelines directly measure whether the retention program is achieving its privacy and compliance objectives.