Data Minimization CDPSE Practice Questions (Page 7)

Questions 31–32

1. 31application · medium

   A financial services company is reviewing its data retention practices. The data inventory shows that customer transaction records are kept for 10 years, although the regulatory requirement is 7 years. The company also has a policy to delete records at the end of the retention period, but the last audit found that some records were not deleted due to a technical error. Which action should the company take to improve compliance with data minimization?

   • ADelete all transaction records immediately to avoid any retention risk.
   • BUpdate the retention schedule to 7 years, and implement automated deletion with periodic audits to verify that deletion occurs.
   • CKeep the 10-year retention period because it provides a buffer for potential regulatory changes.
   • DContinue the 10-year retention but document the technical error in the audit report.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A marketing agency shares customer data with a third-party analytics vendor. The agency currently sends the vendor the full customer database, including names, addresses, and purchase history, to generate reports. The vendor only needs aggregated purchase trends to provide the reports. Which action should the agency take to align with data minimization in third-party sharing?

   • AContinue sending the full database because the vendor is bound by a confidentiality agreement.
   • BSend the full database but pseudonymize the names and addresses before sharing.
   • CProvide the vendor with only the aggregated purchase data, and update the contract to specify that the vendor may only use the data for the agreed reporting purpose.
   • DSend the full database but require the vendor to delete it after generating the reports.
   Reveal Solution Discussion Select an answer first