EUGDPRGDPR PrinciplesEASYFree question
The storage limitation principle states that personal data should be:
- A.Backed up to physical media, under Article 5(1)(e) storage limitation, which fixes a universal two-year retention ceiling for all personal data
- B.Stored forever for compliance purposes, under Article 39(1)(b), which makes the DPO personally and financially liable for the organisation's non-compliance
- C.Always stored in the cloud
- D.Kept in a form that permits identification for no longer than necessary
Why D is correct
Storage limitation requires that personal data be kept in identifiable form only for as long as necessary to fulfill the purpose for which it was collected.
Know someone studying for GDPR? Send them this one.