Which statement reflects GDPR/CCPA considerations for retention and processing of user data?

• A. Minimize Data And Honor Data Subject Rights
• B. Increase Data Collection
• C. Retain Data Indefinitely
• D. Implement Retention Schedules, Secure Deletion, And Document Processing Activities

Answer: (D)

The key idea is that GDPR and CCPA require not only protecting data but also managing how long it’s kept and how processing is tracked. Data minimization and honoring user rights are important, but a complete approach also includes clear rules for how long data is stored, how it’s securely deleted when no longer needed, and how processing activities are documented so you can show what’s being done with data. The best statement aligns with these practices by calling for retention schedules to specify how long data is kept, secure deletion when that data is no longer needed, and keeping records of processing activities to demonstrate compliance. Indefinitely retaining data or simply increasing collection without governance misses these concrete controls, and focusing only on rights or minimization without retention and documentation is incomplete.