One country where the company operates requires transaction records to be retained for several years, while another jurisdiction's privacy law requires that personal data in those same records be deleted once it is no longer needed. What is the BEST approach?

Conflicting legal requirements across jurisdictions are common for multinational organizations, and resolving them requires legal interpretation rather than a security preference. The security manager should engage legal counsel to determine precisely which obligations apply to which records in which jurisdiction, identify whether techniques such as segregation or pseudonymization can satisfy both, and document a jurisdiction-specific decision approved by the appropriate business and legal owners. Applying the longest retention everywhere would keep personal data beyond what the privacy jurisdiction permits, creating a compliance breach there. Applying deletion everywhere would destroy records that the other jurisdiction requires to be kept, creating a breach of retention law and possible loss of evidence in disputes. Leaving each regional IT team to choose the easiest rule delegates a legal and business risk decision to technical staff, produces inconsistent outcomes and leaves no defensible rationale. Exam caveat: the security manager identifies the conflict and its security implications, but does not personally decide how to resolve a legal conflict; that decision rests with legal and business owners. Operational check: confirm that the records retention schedule shows jurisdiction-specific periods, references counsel's opinion, and is reflected in the systems' deletion and archiving configurations.