CIPM Data Retention and Deletion 3

Question 1

When personal data is collected for research purposes under GDPR, what special retention provision applies?

Accepted Answer

Data may be kept longer than the original purpose would allow, provided appropriate safeguards such as pseudonymization are in place

Answer

Research data must be deleted within 12 months of collection regardless of the research timeline

Answer

Research is exempt from all retention requirements once ethics board approval is obtained

Answer

Research data can only be retained if data subjects provide renewed consent annually

Question 2

Which of the following best describes 'anonymization' in the context of data retention?

Accepted Answer

Irreversibly processing data so it can no longer be related to an identified or identifiable individual

Answer

Replacing a name with an employee ID that can be reversed using a lookup table

Answer

Encrypting data so only authorized parties can access identifying information

Answer

Aggregating data into statistical summaries while retaining individual records

Question 3

An organization's HR department wants to retain employee performance reviews indefinitely for historical benchmarking. What should the privacy officer advise?

Accepted Answer

Deny the request and establish a defined retention period tied to a legitimate purpose, with a disposal process

Answer

Approve the request as HR data is generally exempt from retention limitations

Answer

Allow indefinite retention provided the data is encrypted

Answer

Transfer the records to a third-party HR firm to remove organizational liability

Question 4

What is the recommended approach when a data subject submits a right-to-erasure request for data that is subject to a legal retention requirement?

Accepted Answer

Deny the erasure request and document the legal retention obligation that overrides it

Answer

Delete all data immediately to comply with the erasure request regardless of legal obligations

Answer

Anonymize the data as a compromise between erasure and retention

Answer

Escalate the conflict to the data subject's national data protection authority

Question 5

Which of the following is NOT a recognized secure method of destroying paper records containing personal data?

Accepted Answer

Placing documents in a recycling bin without prior shredding

Answer

Cross-cut shredding to DIN 66399 Level P-4 or equivalent

Answer

Incineration in a certified facility

Answer

Pulping or secure recycling with a chain-of-custody certificate

Question 6

How should retention rules be applied to data collected through a mobile application?

Accepted Answer

The same retention schedule that governs the underlying data categories applies, regardless of collection channel

Answer

Mobile app data is exempt from retention requirements as it is user-generated content

Answer

Mobile app data should be retained for a maximum of 90 days by default

Answer

Retention rules only apply if the mobile app uses cloud storage

Question 7

Which of the following metrics would best demonstrate the effectiveness of a data retention program to senior management?

Accepted Answer

Percentage of data categories covered by an approved retention schedule and rate of on-time disposal

Answer

Total volume of data stored across all systems

Answer

Number of employees who completed retention training

Answer

Cost savings from reduced storage infrastructure