CIPP/US: Certified Information Privacy Professional/United StatesDemo

By IAPP · Question Mode

QuestionQ248

The U.S. Privacy Environment

A U.S.-based company finds that several third-party vendors are retaining outdated customer data past the period specified in its retention policy. To follow privacy-program best practices, what should the company do first?

  • A Conduct a vendor risk assessment and update contracts to include data retention obligations.
  • B Reassess its internal data classification schema to ensure it reflects data types used by vendors.
  • C Notify regulators that customer data may have been improperly retained by the vendors.
  • D Request that the vendors delete all outdated customer data and provide confirmation.
Explanation

Data that has exceeded its approved retention period should be destroyed in accordance with policy. Directing the vendors to delete the outdated customer data and confirm completion immediately remediates the known over-retention; vendor assessment and contractual improvements can follow to prevent recurrence. NIST’s Privacy Framework identifies both destruction of data according to policy and the use of contracts and assessments to manage third-party privacy obligations.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!