Which statement best describes a data retention policy?

• A. A policy that governs how encryption keys are rotated.
• B. Rules governing who can access backups.
• C. Rules governing how long data is kept and when it is safely deleted.
• D. A procedure for incident response.

Answer: (C)

The statement being tested focuses on how long data is kept and when it’s safely deleted. A data retention policy specifies the retention periods for different kinds of data, defines when data should be archived or deleted, and ensures that deletion is performed securely. It ties the data lifecycle to compliance needs, risk reduction, and storage management, making it the best description because it directly addresses both the duration data is held and the timing of its disposal.

Other options describe different kinds of policies or procedures that aren’t about how long data is retained. Rotation of encryption keys concerns cryptographic key management, not how long data should be kept. Rules about who can access backups relate to access control and data protection, not retention timing. Incident response outlines steps after a security incident, not the ongoing handling and disposal of data.