What does a data retention policy specify?

• A. Rules about how long to keep records
• B. Who will be allowed to review the policy
• C. Which hardware to use for storage
• D. Whether to rename records

Answer: (A)

A data retention policy specifies how long records must be kept and when they should be disposed of or archived. It sets retention periods for different types of data, aligning with legal, regulatory, and business needs, and defines the lifecycle from creation to final destruction. This guidance helps ensure information is available when needed but not kept longer than required, with clear rules for secure destruction when the retention period ends. Other options relate to who can review the policy, the storage hardware, or how records might be renamed—matters more about governance, infrastructure, or operational practices than about how long data should be retained.