Question 16
Domain 2 — Personal Data Lifecycle ManagementWhich of the following is the BEST indication of an effective records management program for personal data?
Correct answer: D
Explanation
A retention schedule shows that personal data is being managed under defined rules for how long it is kept and when it is disposed of. In records management, a documented schedule is a core control because it supports orderly retention and deletion rather than indefinite storage.
Why each option is right or wrong
A. Archived data is used for future analytics
Using archived data for analytics describes reuse, not governed retention or disposal of personal data.
B. The legal department has approved the retention policy
Legal approval helps policy governance, but approval alone does not prove operational records management exists.
C. All sensitive data has been tagged
Tagging sensitive data aids classification, but classification alone is not a retention and deletion program.
D. A retention schedule is in place
Under the GDPR, storage limitation in Article 5(1)(e) requires personal data to be kept no longer than necessary for the purposes for which it is processed, and Article 5(2) places accountability on the controller to demonstrate compliance. A documented retention schedule is the clearest operational evidence that those time limits are defined and applied, rather than data being retained indefinitely or ad hoc.