hardMultiple Choice
CISA Practice Question: Is implementing a data retention policy for…
An organization is implementing a data retention policy for personally identifiable information (PII) to comply with GDPR. Which of the following is the MOST appropriate approach?
⚠ Common exam trap
Many exam-takers confuse 'anonymization' (Option B) as a safe harbor for indefinite retention, but GDPR requires that anonymization be irreversible and that the retained data serve a legitimate purpose, not just be kept indefinitely without justification.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Define retention periods based on legal and business requirements and securely delete after
GDPR mandates that PII must not be kept longer than necessary for the purpose for which it was collected. Defining retention periods based on legal and business requirements ensures compliance with the storage limitation principle (Article 5(1)(e)), and secure deletion (e.g., using cryptographic erasure or overwriting with tools like shred on Linux) prevents unauthorized recovery. This approach balances regulatory compliance with operational needs.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Delete PII as soon as it is collected
Why it's wrong here
Immediate deletion may conflict with legitimate processing purposes; retention periods must be defined.
- ✗
Anonymize PII after a fixed period and retain indefinitely
Why it's wrong here
Anonymized data is not PII and can be retained, but indefinite retention of PII before anonymization is not allowed.
- ✗
Retain PII indefinitely for historical analysis
Why it's wrong here
Indefinite retention directly violates GDPR's storage limitation principle, which requires PII be kept no longer than necessary for its stated purpose. It is tempting because historical analysis can yield genuine business value, and retaining everything is operationally effortless; that approach suits aggregated, non-personal datasets where no erasure obligation applies.
- ✓
Define retention periods based on legal and business requirements and securely delete after
Why this is correct
GDPR requires storage limitation, so retention periods must derive from specific legal and business justifications rather than blanket indefinite storage. Securely deleting PII once those periods expire enforces the principle, satisfying the regulation's requirement that personal data be kept no longer than necessary.
Go deeper
Related to this question
About these practice questions
One of 934 original CISA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.