Which description accurately defines a data retention policy?

Which description accurately defines a data retention policy?

• A. Procedures for encrypting data at rest.
• B. Rules governing how long data is kept and when it is safely deleted.
• C. Processes for monitoring network traffic.
• D. Lists authorized users for resources.

Answer: (B)

A data retention policy determines how long data is kept and when it is safely deleted. It sets the lifecycle for information, covering what to preserve, how long to store it, where it should be kept (active systems vs. archives), and the secure disposal methods when the retention period ends. This helps with regulatory compliance, legal risk, and data management by ensuring that data isn’t kept longer than needed and that it’s disposed of securely when appropriate. For example, financial records might be kept for a legally required number of years and then wiped or anonymized to prevent unnecessary retention. Other options describe protections or controls that aren’t about how long data is kept. Encrypting data at rest focuses on protecting data’s confidentiality while stored, not on retention timelines. Monitoring network traffic is about detecting and responding to activity on the network. Lists of authorized users relate to access control and who can view data, not how long data remains stored.

A data retention policy determines how long data is kept and when it is safely deleted. It sets the lifecycle for information, covering what to preserve, how long to store it, where it should be kept (active systems vs. archives), and the secure disposal methods when the retention period ends. This helps with regulatory compliance, legal risk, and data management by ensuring that data isn’t kept longer than needed and that it’s disposed of securely when appropriate. For example, financial records might be kept for a legally required number of years and then wiped or anonymized to prevent unnecessary retention.

Other options describe protections or controls that aren’t about how long data is kept. Encrypting data at rest focuses on protecting data’s confidentiality while stored, not on retention timelines. Monitoring network traffic is about detecting and responding to activity on the network. Lists of authorized users relate to access control and who can view data, not how long data remains stored.