CIPM Data Retention and Deletion 3

Question 1

When personal data is collected for research purposes under GDPR, what special retention provision applies?

Accepted Answer

Data may be kept longer than the original purpose would allow, provided appropriate safeguards such as pseudonymization are in place

Answer

GDPR Article 89 permits derogations to the storage limitation for research purposes when appropriate safeguards like pseudonymization protect data subject rights.

Question 2

Which of the following best describes 'anonymization' in the context of data retention?

Accepted Answer

Irreversibly processing data so it can no longer be related to an identified or identifiable individual

Answer

True anonymization irreversibly prevents re-identification; once genuinely anonymized, data falls outside the scope of privacy regulations and retention rules for personal data.

Question 3

An organization's HR department wants to retain employee performance reviews indefinitely for historical benchmarking. What should the privacy officer advise?

Accepted Answer

Deny the request and establish a defined retention period tied to a legitimate purpose, with a disposal process

Answer

Storage limitation principles prohibit indefinite retention of personal data; the privacy officer should work with HR to define a purpose-based retention period and secure disposal process.

Question 4

What is the recommended approach when a data subject submits a right-to-erasure request for data that is subject to a legal retention requirement?

Accepted Answer

Deny the erasure request and document the legal retention obligation that overrides it

Answer

When a legal retention obligation exists, it constitutes grounds to refuse erasure; the organization should document this reason and communicate it to the data subject.

Question 5

Which of the following is NOT a recognized secure method of destroying paper records containing personal data?

Accepted Answer

Placing documents in a recycling bin without prior shredding

Answer

Placing documents in an open recycling bin without shredding does not constitute secure destruction, as the data remains readable and accessible.

CIPM - Certified Information Privacy Manager Practice Test

CIPM - Certified Information Privacy Manager Practice Test

CIPM Data Retention and Deletion 3