Question 14
Domain 2 — Personal Data Lifecycle ManagementAn organization is creating a personal data processing register to document actions taken with personal dat a. Which of the following categories should document controls relating to periods of retention for personal data?
Correct answer: A
Explanation
Data archiving is the category used to document retention controls because retention periods determine when personal data is kept, moved to archive, or disposed of. A processing register should record these lifecycle controls so the organization can show how long personal data is retained and what happens at the end of that period.
Why each option is right or wrong
A. Data archiving
Under GDPR Article 30(1), the record of processing activities must include, where possible, the envisaged time limits for erasure of the different categories of data. Controls that specify how long personal data is kept, when it is transferred to archive, and when it is deleted are therefore recorded under the archiving/retention lifecycle entry, not under collection or use. In this question, the register item tied to retention periods is the archiving category because it captures the 30-day, 1-year, or other defined retention rule and the end-of-life action for the data.
B. Data storage
Data storage covers where data is kept, not how long it must be retained.
C. Data acquisition
Data acquisition concerns collecting personal data, not managing its retention period afterward.
D. Data input
Data input focuses on entering data into systems, not lifecycle retention controls.