Which statement best describes data retention governance for AI systems?

Which statement best describes data retention governance for AI systems?

• A. Retention limits, deletion rights, data minimization, and archival requirements.
• B. Retention limits, deletion rights, data minimization, legal holds, and archival requirements with auditable controls.
• C. Data minimization alone.
• D. No retention governance required.

Answer: (B)

Data retention governance for AI systems combines how long data is kept, how individuals can exercise deletion rights, keeping only what’s necessary, and planning for archiving, all in a way that can be verified through auditable controls. The strongest approach explicitly covers legal holds and archival requirements while ensuring there are verifiable records of how data is managed. Legal holds are important because they preserve relevant data during litigation or investigations, preventing premature deletion that could hinder legal process. Archival requirements ensure older data is moved to appropriate storage rather than kept indefinitely in active systems, aligning with retention policies and cost/risk considerations. Auditable controls—logs, access logs, and defined processes—make it possible to demonstrate compliance, investigate incidents, and support accountability. The other options fall short because they omit one or more essential elements. Focusing only on data minimization ignores the realities of retention timing, deletion rights, and the need to preserve data for legal or business purposes. Ending with no retention governance is outside best practice and could lead to uncontrolled data growth, privacy risks, and compliance failures. Including archival requirements without auditable controls, or without legal holds, leaves gaps in accountability and the ability to prove compliance during audits.

Data retention governance for AI systems combines how long data is kept, how individuals can exercise deletion rights, keeping only what’s necessary, and planning for archiving, all in a way that can be verified through auditable controls. The strongest approach explicitly covers legal holds and archival requirements while ensuring there are verifiable records of how data is managed. Legal holds are important because they preserve relevant data during litigation or investigations, preventing premature deletion that could hinder legal process. Archival requirements ensure older data is moved to appropriate storage rather than kept indefinitely in active systems, aligning with retention policies and cost/risk considerations. Auditable controls—logs, access logs, and defined processes—make it possible to demonstrate compliance, investigate incidents, and support accountability.

The other options fall short because they omit one or more essential elements. Focusing only on data minimization ignores the realities of retention timing, deletion rights, and the need to preserve data for legal or business purposes. Ending with no retention governance is outside best practice and could lead to uncontrolled data growth, privacy risks, and compliance failures. Including archival requirements without auditable controls, or without legal holds, leaves gaps in accountability and the ability to prove compliance during audits.