The retention period that company policy sets for closed customer accounts has ended, and legal counsel confirms that no legal hold applies to those records. Which action should follow in the data management life cycle?
Select an answer to reveal the explanation.
Short Explanation
Retention's a 'keep until' date, not a 'keep forever' suggestion. Once the clock runs out and there's no legal hold, the records move to disposal, and you destroy them in a way that fits how sensitive they were. Hanging onto them 'just in case' only grows what an attacker can steal.
Full Explanation
The data management life cycle moves through creation, management, distribution, retention and disposal. Retention defines how long records must be kept to satisfy business, regulatory and legal requirements; when that period ends and no legal hold extends it, the next stage is disposal. Disposal must be secure and proportional to the classification, for example cryptographic erasure or overwriting for digital records and certified destruction for media, with documentation that it occurred. Archiving indefinitely contradicts the retention policy, increases breach impact and can violate privacy obligations to keep personal data no longer than necessary. Reclassifying customer records as public to relax storage controls misrepresents their sensitivity; classification follows content and impact, not convenience, and the records still contain personal information. Distributing the records for analytics after their retention period ends is new processing of data that should be destroyed, and retention clocks do not reset because someone wants more use from the data. Exam caveat: a legal hold suspends disposal for the affected records, so confirming no hold applies, as counsel did here, is a required precondition. Operational check: run the disposal job against the expired record set, confirm the records cannot be recovered from production or backup copies within their own cycles, and keep a disposal log or certificate.