A company must set retention periods for invoices, system logs and employee chat messages held in several cloud services. How should the retention period for each kind of record be determined?
Select an answer to reveal the explanation.
Short Explanation
Different records have different clocks: tax rules care about invoices, security needs logs, and chat might hold barely anything worth keeping. You set each clock from the laws and business needs for that type. A one-size-fits-all period is the trap, because keeping too much is a risk too.
Full Explanation
A data retention policy specifies how long each category of data must be kept, where and how it is stored, and what happens at the end of the period. Retention periods are derived per record type from applicable legal, regulatory and contractual requirements together with legitimate business needs, so invoices may follow tax and accounting rules, security logs may follow audit and incident investigation needs and chat messages may follow employment, litigation and privacy considerations. Each category is then mapped to the services where it resides so the period is enforced consistently. A single uniform period set to the longest requirement over-retains most records, increasing breach impact, eDiscovery scope and storage cost, and may conflict with privacy principles such as storage limitation. Provider defaults are configuration starting points chosen for general use; they do not reflect the customer's legal obligations and may delete data too early or keep it too long. Deciding by storage cost ignores legal requirements entirely and can cause unlawful early destruction of records that must be kept. Exam caveat: legal hold overrides the normal schedule for records relevant to litigation. Operational check: confirm each record type in the retention schedule cites its requirement source and that lifecycle settings in each service match.