Exam CIPT topic 1 question 13 discussion

Deletion is the main action you would take after retention periods end. The worst thing to do would be to re-tag the data.

D , question asked " NOT"

The correct answer is D. Retagging. Retagging is not a suitable action to apply to data when the retention period ends. When data retention periods end, the data should either be deleted, de-identified, or aggregated to ensure that it no longer poses a privacy risk. Retagging would not address the need to limit access to or eliminate the data in accordance with retention policies.

Rettaging

I would say D

Aggregation

Data aggregation is a process in which data is gathered and represented in a summary form, for purposes including statistical analysis. That would mean using the data after the retention period has been reached. and that does not make sense. B. De-identification, could be a mean to keep the data under an anonymized format, and so under the condition of the collection it could make sense C. Deletion, it the most common way to deal with data when they reach the end of their retention period. D. Retagging, is in fact extending or resetting the retention period. For example because the PII of customers are kept for a defined retention period of 3 years EXCEPT if the customer had interaction if the Data controller during those 3 years, then the data is re-tag and kept.

C is correct. Aggregation is a common backup/retention solution. You can de-identity and you can of course retag so you can know what you can delete or what you should archive. Archive is the next step after retention.