hardMultiple ChoiceObjective-mapped
CISSP Practice Question: A multinational corporation is designing a data…
A multinational corporation is designing a data retention schedule. Which factor is most critical when determining retention periods for personal data subject to the GDPR?
⚠ Common exam trap
ISC2 often tests the misconception that legal holds or contractual agreements override the primary GDPR requirement, but the trap here is that candidates confuse operational constraints (cost, contracts) with the regulatory mandate that purpose must dictate retention.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The purpose for which the data was collected
Under the GDPR, Article 5(1)(e) establishes the 'storage limitation' principle, which mandates that personal data must be kept no longer than necessary for the purposes for which it was collected. Therefore, the purpose of collection is the primary driver for determining the retention period, as it defines the lawful basis and necessity for processing. Without a defined purpose, any retention period would be arbitrary and non-compliant with the regulation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The length of the third-party data processing agreement
Why it's wrong here
Data retention periods are primarily dictated by legal, regulatory, and business requirements tied to the data's original purpose, not solely by the term of a contractual agreement with a third-party processor. While such an agreement specifies data handling during its active term, it does not establish the fundamental minimum or maximum retention duration mandated by external compliance obligations or the initial collection justification. The agreement itself must conform to these overarching retention mandates.
- ✓
The purpose for which the data was collected
Why this is correct
This is the fundamental driver for data retention, directly aligning with privacy principles such as "storage limitation" found in regulations like GDPR and CCPA. Data should only be retained for as long as it is necessary to fulfill the specific, explicit, and legitimate purposes for which it was originally collected, or for subsequent compatible purposes, unless a legal or regulatory obligation explicitly dictates a longer period. This principle minimizes data exposure and associated risks.
- ✗
The cost of storage media
Why it's wrong here
While storage costs are a significant operational consideration for any organization, they are not a legitimate factor in determining data retention periods from a compliance or legal perspective. Organizations are legally and ethically obligated to retain data for specific durations, irrespective of the expense, to meet regulatory mandates, fulfill audit requirements, or respond to potential legal discovery. Cost optimization strategies must always operate within the boundaries set by these non-negotiable compliance obligations.
- ✗
The duration of any pending legal holds
Why it's wrong here
Legal holds are reactive measures that serve to suspend or override standard data destruction schedules for specific data relevant to anticipated or ongoing litigation, investigations, or audits. They effectively extend retention for particular datasets but do not establish the initial or baseline retention period for data. The fundamental data retention schedule is proactively defined by the data's original collection purpose and applicable legal or regulatory requirements, with legal holds acting as a temporary, case-specific modification.
Go deeper
Related to this question
Learn chapter
Asset Security: Privacy and Data Retention
Key term
GDPR
The General Data Protection Regulation (GDPR) is a European Union law that sets strict rules for how organizations collect, store, process, and protect the personal data of individuals within the EU.
Key term
Data retention
Data retention is the practice of keeping data for a specific period to meet legal, business, or compliance needs, and then securely disposing of it.
About these practice questions
One of 747 original CISSP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.