How should data retention and access rights be handled to align with policy?

• A. Assign all users broad access to data for flexibility.
• B. Align with data retention policies; ensure access rights reflect current necessity; purge when appropriate.
• C. Keep data indefinitely and ignore retention policies.
• D. Purge all data immediately after onboarding.

Answer: (B)

The main idea is to manage data based on policy: keep data only as long as required and grant access strictly to what is needed for the job. This means tying access rights to current necessity and regularly reviewing who has access, adjusting or revoking as roles change. When the retention period ends or data is no longer needed, purge or properly dispose of it in line with policy. This approach reduces risk, supports compliance with regulatory and internal rules, and makes audits smoother.

Broad, unwarranted access increases exposure and violates the need-to-know principle. Keeping data indefinitely ignores retention policies and heightens risk. Purging immediately after onboarding would delete information that may be needed for operations or compliance.