CIPM Data Retention and Deletion

Question 1

What is the primary principle behind data retention schedules in a privacy program?

Accepted Answer

Keeping data only as long as necessary for its specified purpose

Answer

Retaining data as long as technically possible to support future needs

Answer

Storing all data indefinitely to comply with potential legal holds

Answer

Retaining data based solely on business unit preferences

Question 2

Which of the following best describes a data retention schedule?

Accepted Answer

A document mapping data categories to their required retention periods and disposal methods

Answer

A log of all employees who accessed personal data

Answer

A backup policy for archiving data to offsite storage

Answer

A list of data subjects who have opted out of data collection

Question 3

When establishing retention periods, which factor should take highest priority?

Accepted Answer

Legal and regulatory requirements

Answer

Internal storage cost reduction targets

Answer

Vendor contract terms

Answer

Employee convenience and workflow preferences

Question 4

What is a 'legal hold' in the context of data retention?

Accepted Answer

A suspension of normal deletion schedules due to anticipated or ongoing litigation

Answer

A regulatory prohibition on collecting certain categories of data

Answer

A contractual obligation to share data with a third party

Answer

A data subject's request to restrict processing

Question 5

Which method is most appropriate for securely disposing of personal data stored on solid-state drives (SSDs)?

Accepted Answer

Cryptographic erasure (destroying the encryption keys)

Answer

Overwriting with zeros using a single-pass wipe

Answer

Physical degaussing with a strong magnetic field

Answer

Standard file deletion through the operating system

Question 6

Under the GDPR's storage limitation principle, personal data should be:

Accepted Answer

Kept in a form that permits identification no longer than necessary

Answer

Retained for at least five years to ensure business continuity

Answer

Stored in encrypted form indefinitely as encryption satisfies the requirement

Answer

Deleted only upon a data subject's explicit request

Question 7

What is 'data minimization' as it relates to retention?

Accepted Answer

Collecting and retaining only the data that is adequate, relevant, and limited to what is necessary

Answer

Compressing data files to reduce storage costs

Answer

Anonymizing data before long-term archiving

Answer

Reducing the number of systems that store personal data