What data privacy consideration requires organizations to define how long data is kept and how breaches are reported?

• A. Encryption
• B. User authentication
• C. Data retention and breach notification
• D. Password management policy

Answer: (C)

Data retention and breach notification focus on two essential aspects of privacy governance: how long personal data is stored and how security incidents are reported. Establishing data retention means setting clear timelines for retaining different data types, implementing secure disposal when those timelines end, and minimizing how long data is exposed. Breach notification defines the process and timing for reporting any security incidents to regulators and affected individuals, aligning with legal requirements and enabling prompt response. This combination reflects a mature privacy program that handles data responsibly and prepares for incident management. Encryption, user authentication, and password management are important controls for protecting data and controlling access, but they do not specify data lifecycle timing or reporting obligations.