A retention schedule deletes live CRM records on time, but backup tapes indefinitely retain the same personal data with no workable purge path. What does storage limitation require in this situation?
Select an answer to reveal the explanation.
Short Explanation
Deleting the live record while forever-hoarding the same person on backup tapes is like shredding the front page and framing the carbon copy. Storage limitation has to reach the copies that still identify people, within what is feasible. A schedule that ignores backups is only half a schedule.
Full Explanation
Storage limitation under Article 5(1)(e) concerns how long personal data remain in identifiable form for the purposes of processing. Controllers should design retention so that backup and archive copies do not indefinitely preserve identifiable personal data beyond necessity where feasible technical and organisational measures allow. A live-system deletion schedule that leaves unbounded identifiable backups undermines the effectiveness of storage limitation.