Records Management & Data Privacy Flashcards

Under GDPR, which principle requires that personal data be kept in a form that permits identification of data subjects for no longer than necessary?

Answer: Storage limitation

The storage limitation principle under GDPR requires that personal data be kept in identifiable form only as long as necessary for the stated purpose.

A company receives a litigation hold notice after existing records have already been scheduled for destruction. What is the correct action?

Answer: Suspend the destruction and preserve all potentially relevant records

A litigation hold supersedes any existing retention schedules and requires immediate suspension of destruction for all potentially relevant records.

Which ISO standard specifically addresses records management systems and their requirements?

Answer: ISO 15489

ISO 15489 is the international standard specifically dedicated to records management, covering principles and implementation guidelines.

A data subject requests deletion of their personal data under CCPA. Under which circumstance may the business lawfully refuse?

Answer: The data is necessary to complete a transaction the consumer requested

CCPA allows businesses to deny deletion requests when the data is necessary to complete a transaction the consumer requested or reasonably anticipated.

What is the primary purpose of a records inventory in an information governance program?

Answer: To identify what records exist, where they are located, and how they are managed

A records inventory establishes a baseline understanding of what records exist, their location, format, and management practices before any governance decisions are made.

Which data privacy concept gives individuals the right to receive their personal data in a structured, commonly used, machine-readable format?

Answer: Right to data portability

The right to data portability, established under GDPR Article 20, allows individuals to receive and transfer their personal data in a reusable format.

In records management, what distinguishes a 'record' from a 'non-record'?

Answer: Records document organizational activities and have ongoing value; non-records are transitory

Records are documents that provide evidence of organizational activities and have ongoing business, legal, or historical value, distinguishing them from transitory non-records like draft copies.