CIPM Data Retention and Deletion

Question 1

What is the primary principle behind data retention schedules in a privacy program?

Accepted Answer

Keeping data only as long as necessary for its specified purpose

Answer

The data minimization and storage limitation principles require that personal data be kept only as long as necessary for the purpose for which it was collected.

Question 2

Which of the following best describes a data retention schedule?

Accepted Answer

A document mapping data categories to their required retention periods and disposal methods

Answer

A data retention schedule maps each category of data to its mandated or appropriate retention period and the method of secure disposal at end of life.

Question 3

When establishing retention periods, which factor should take highest priority?

Accepted Answer

Legal and regulatory requirements

Answer

Legal and regulatory requirements set the minimum baseline for retention periods, and failure to comply can result in penalties and liability.

Question 4

What is a 'legal hold' in the context of data retention?

Accepted Answer

A suspension of normal deletion schedules due to anticipated or ongoing litigation

Answer

A legal hold (or litigation hold) suspends routine data disposal obligations when litigation, investigation, or audit is reasonably anticipated.

Question 5

Which method is most appropriate for securely disposing of personal data stored on solid-state drives (SSDs)?

Accepted Answer

Cryptographic erasure (destroying the encryption keys)

Answer

SSDs use wear-leveling that makes overwriting unreliable; cryptographic erasure renders data unrecoverable by destroying the keys used to encrypt it.

CIPM - Certified Information Privacy Manager Practice Test

CIPM - Certified Information Privacy Manager Practice Test

CIPM Data Retention and Deletion