CIPM Data Retention and Deletion 2

Question 1

Which of the following is a key element of an effective data destruction certification?

Accepted Answer

Documentation of the date, method, and identity of personnel who performed destruction

Answer

Signature of the data subject whose data was destroyed

Answer

Approval from the Chief Marketing Officer

Answer

A copy of the data that was destroyed for audit purposes

Question 2

How should an organization handle personal data in backup systems when the primary data has reached its retention limit?

Accepted Answer

The organization should establish processes to purge expired data from backups on a scheduled basis

Answer

Backups are exempt from retention requirements and can be kept indefinitely

Answer

Only encrypt the backup data rather than deleting it

Answer

Transfer backup data to a third-party for long-term archiving

Question 3

What role does a Records Retention Policy play in a privacy program?

Accepted Answer

It establishes organization-wide rules for how long records are kept and how they are disposed of

Answer

It defines the technical architecture for storing records

Answer

It authorizes data subjects to access their personal data

Answer

It determines which employees can view sensitive records

Question 4

Which of the following scenarios requires a reassessment of existing retention periods?

Accepted Answer

New legislation changes the minimum retention requirement for a data category

Answer

A new software version is deployed to manage records

Answer

An employee is promoted to a records management role

Answer

The organization changes its email provider

Question 5

What is 'pseudonymization' and how does it relate to retention?

Accepted Answer

Replacing direct identifiers with a key, allowing re-identification, but reducing risk during longer retention periods

Answer

Permanently removing all identifiers from data so it can be kept indefinitely without restriction

Answer

Encrypting data to prevent unauthorized access during the retention period

Answer

Converting data to an anonymous format immediately upon collection

Question 6

Under the California Consumer Privacy Act (CCPA), businesses must inform consumers about:

Accepted Answer

The length of time each category of personal information will be retained, or the criteria used to determine it

Answer

The specific employees responsible for managing their data

Answer

The exact server locations where data is stored

Answer

The profit generated from selling their personal information

Question 7

What is the purpose of a data inventory or data map in managing retention?

Accepted Answer

To identify all data categories, their locations, and owners so retention schedules can be applied consistently

Answer

To monitor employee access to personal data in real time

Answer

To automatically delete data when it reaches its retention limit

Answer

To encrypt data at rest across all organizational systems