Sign in Subscribe

Data Retention

Data Retention covers how long organizations keep personal data and when it must be deleted, anonymized, or otherwise disposed of. This tag addresses retention periods, storage limitation, retention schedules, legal and business requirements, deletion practices, litigation holds, and data lifecycle management across privacy and data protection laws, including the GDPR, CCPA, and other U.S. state privacy laws.

CCPA Cybersecurity Audit Requirements: Understanding Article 9 of the CalPrivacy Regulations

CCPA Cybersecurity Audit Requirements: Understanding Article 9 of the CalPrivacy Regulations

California's proposed CCPA cybersecurity audit regulations require certain businesses to conduct independent annual audits and executive certifications. This guide explains who is covered, what must be audited, and how to build a compliant cybersecurity governance program.

Data Protection by Design and by Default Under the GDPR: What Article 25 Requires

Data Protection by Design and by Default Under the GDPR: What Article 25 Requires

Learn what data protection by design and by default means under Article 25 GDPR, including privacy-protective defaults, data minimization, risk-based safeguards, accountability, DPIAs, processor selection, and how organizations can build data protection into systems from the start.

Nowak: When an Exam Answer Becomes Personal Data

Nowak: When an Exam Answer Becomes Personal Data

Nowak explains when information “relates to” a person under EU data protection law. The CJEU held that exam answers and examiner comments can be personal data and established the influential content, purpose, or effect test for determining when information is linked to an individual.