A company keeps every email, file and log in its cloud tenant indefinitely, on the theory that it might need them someday. What is the main risk the security manager should raise about this practice?
Select an answer to reveal the explanation.
Short Explanation
Keeping everything forever feels safe, but it's really a giant pile of liability waiting for a breach or a lawsuit. Every extra year of data is more you can lose and more you'll have to search and hand over. Privacy laws also expect you to delete what you no longer need.
Full Explanation
Retention should be as long as legally and operationally required, and no longer. Keeping all data indefinitely increases risk in several ways. A breach exposes everything ever stored, so the impact and notification obligations grow with the data volume. In litigation, all retained data is potentially discoverable, so eDiscovery scope, review effort and cost expand, and old records can create unexpected liability. Privacy regulations such as GDPR include storage limitation and data minimization principles, so keeping personal data beyond its purpose can itself be a compliance violation. Indefinite retention does not guarantee legal defensibility; defensible practice means following a documented, consistently applied retention and disposition policy, and keeping everything can complicate legal positions rather than help them. Providers do not automatically anonymize customer data after a period; customers remain responsible for disposing of or de-identifying their data. Retaining forever does not satisfy every regulation, because some laws require deletion after a purpose ends, so a policy is still needed. Exam caveat: disposition must pause for any records subject to legal hold. Operational check: compare stored data age against the retention schedule and quantify how much data exceeds its required period.