Certified Information Privacy Technologist (CIPT) — Question 195

Which of the following is the best action to apply to personally identifiable data when the retention period ends?

Answer options

• A. Hashing
• B. Pseudonymization
• C. Tagging.
• D. Deletion

Correct answer: D

Explanation

The correct answer is D, Deletion, because once the retention period for personally identifiable data has ended, it is essential to remove that data to prevent any unauthorized access or misuse. Hashing, pseudonymization, and tagging do not fully eliminate the data and may still leave it vulnerable to exposure.