How should data retention policies be audited to ensure compliance with legal requirements and data minimization?

• A. Delete data immediately after collection.
• B. Review retention schedules and legal holds only.
• C. Review retention schedules, legal holds, deletion processes, data minimization, and assurance that data is not retained longer than necessary.
• D. Ignore data minimization concerns.

Answer: (C)

Auditing data retention policies must verify that every piece of data is kept only as long as necessary to meet legal obligations and the stated business purpose. The strongest approach looks at the full lifecycle: first, ensure the retention schedules themselves reflect applicable laws and regulations so data isn’t kept longer than required. Next, confirm that legal holds are properly managed and cannot be bypassed, since litigation or investigations may dictate temporary preservation beyond normal retention periods. Then examine deletion processes to guarantee data is destroyed in a timely, verifiable way when it no longer serves a purpose or isn’t legally required to be kept. Importantly, assess data minimization—verify that only data needed for the defined purposes is collected and stored, and that unnecessary data is not retained. Finally, obtain evidence that data is not kept longer than necessary, with controls and records showing periodic reviews and verification.

Focusing only on schedules and holds misses critical controls around timely deletion, practical data minimization, and ongoing assurance. Deleting data immediately after collection may conflict with legitimate needs or legal holds. Ignoring data minimization undermines privacy principles and can increase risk.