How should data retention and deletion policies be designed and communicated?

• A. Delete data after a fixed 90 days regardless of type.
• B. Retain all data indefinitely and delete only upon explicit request.
• C. Define retention periods by data type, establish secure deletion methods, and clearly convey policies to stakeholders.
• D. Communicate retention only to IT staff.

Answer: (C)

Designing and communicating data retention and deletion policies hinges on managing data through its lifecycle by type. Different data categories have distinct value, risk, and legal obligations, so retention periods should be defined for each data type rather than applying one universal rule. When a retention window ends, secure deletion methods must be in place to ensure data is actually removed or irreversibly anonymized, preventing recovery. Equally important is communicating these policies clearly to all stakeholders—data owners, users, compliance teams, and IT—so everyone understands what will be kept, for how long, and how deletion happens. This approach balances operational needs with privacy, security, and regulatory requirements.