Using Data Lifecycle Management to Permanently Delete Personal Data for GDPR
Your organization is subject to GDPR and must respond to data subject deletion requests within 30 days. You have identified all personal data in Microsoft 365. Which Microsoft Purview solution should you use to permanently delete the data?
Quick Answer
The answer is Data Lifecycle Management with a disposition review. This solution is correct because it provides a formal, auditable process to permanently delete content after a designated review period, which is essential for complying with GDPR data subject deletion requests within the 30-day window. In the SC-900 exam, this question tests your understanding of how Microsoft Purview’s lifecycle management tools handle data disposal versus other security controls; a common trap is confusing eDiscovery’s export capability with deletion, or assuming retention policies can permanently remove data. Remember the memory tip: “Disposition deletes, retention retains, eDiscovery exports, and DLP protects.”
⚠ Common exam trap
Many exam-takers confuse retention policies (which preserve data) with lifecycle management (which can delete data), or they mistakenly think DLP or eDiscovery can perform permanent deletion, when in fact they are designed for blocking or exporting data, respectively.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Data Lifecycle Management (disposition review)
Data Lifecycle Management (disposition review) is the correct solution because it allows you to permanently delete personal data after a specified retention period. In this scenario, you have already identified the personal data and need to respond to a deletion request within 30 days. Disposition review provides a workflow to review and then permanently delete the data, meeting GDPR requirements.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Retention policies to preserve the data
Why it's wrong here
Retention policies preserve data, not delete.
- ✓
Data Lifecycle Management (disposition review)
Why this is correct
Disposition review allows administrators to permanently delete content after review.
- ✗
Data Loss Prevention to block the data
Why it's wrong here
Blocking does not delete data.
- ✗
eDiscovery (Premium) to export the data
Why it's wrong here
Export does not delete the data from the source.
Go deeper
Related to this question
Learn chapter
Microsoft Entra ID
Key term
Organization
An Organization is a top-level container in Google Cloud that represents your company or entities and serves as the root node for all your cloud resources, policies, and access control.
Key term
General Data Protection Regulation
A European Union law that gives individuals control over their personal data and sets strict rules for how organizations collect, store, and process that data.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,250 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SC-900
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which TWO Microsoft Purview solutions help organizations respond to data subject requests under GDPR?
easy- ✓ A.eDiscovery
- B.Information barriers
- ✓ C.Data Lifecycle Management
- D.Data Loss Prevention (DLP)
- E.Communication compliance
Why A: eDiscovery (A) is correct because it enables organizations to search for and export personal data across Microsoft 365 workloads (Exchange, SharePoint, OneDrive, Teams) to fulfill data subject access and export requests under GDPR Article 15. Data Lifecycle Management (C) is correct because it allows organizations to retain personal data for the minimum necessary period and permanently delete it when no longer needed, supporting the right to erasure under GDPR Article 17.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.