Which GDPR/CCPA considerations are important for handling user account data and retention?

• A. Increase Data Collection To Maximize Analytics
• B. Document Processing Activities
• C. Minimize Personal Data And Honor Data Subject Rights
• D. Store All Data Permanently

Answer: (C)

Data minimization and honoring data subject rights are the practical heart of how GDPR and CCPA guide handling of user accounts and retention. By collecting only what’s truly necessary to operate the account and provide the service, you reduce risk, limit exposure, and make compliance clearer. This means choosing only essential data to store, using secure practices (like hashing passwords), and implementing clear retention policies so personal data isn’t kept longer than needed. When users request access to their data, deletion, or data portability, you have to respond and adjust what you hold accordingly. These actions align with GDPR’s limits on data collection and its rights to erasure and portability, and with CCPA’s rights to know, delete, and opt out of data sales. In practice, you design your data collection around the account’s purpose, set and enforce retention schedules, and have processes to fulfill data subject requests.

Documenting processing activities is important for privacy governance, but it doesn’t directly address how long you keep data or the user rights to control it. Storing all data permanently violates the retention principle and is generally inappropriate under GDPR/CCPA. Increasing data collection beyond what’s needed contradicts minimization and can complicate compliance.