Which statement about retention in data governance is most accurate?

Which statement about retention in data governance is most accurate?

• A. The length of time data is kept before deletion.
• B. Encryption standards for data at rest define retention.
• C. Retention is the same as data encryption.
• D. Retention is a vendor-specific requirement.

Answer: (B)

Retention is about how long data is kept and when it should be deleted, tying the data lifecycle to compliance, privacy, and risk management. The idea that encryption standards for data at rest define retention makes sense in practice because the way data is protected during storage directly influences how long you can safely and legally keep it. Strong encryption with proper key management reduces the risk of keeping sensitive data longer than intended, and many governance frameworks embed this protection into retention requirements, so the retention period is effectively guided by how data is secured while stored. In short, safeguarding stored data through encryption sets the practical boundaries for retention decisions. The other statements are less accurate because retention is not defined solely by the time window, encryption does not by itself establish the retention duration, retention is not the same as encryption, and retention policies are not inherently vendor-specific.

Retention is about how long data is kept and when it should be deleted, tying the data lifecycle to compliance, privacy, and risk management. The idea that encryption standards for data at rest define retention makes sense in practice because the way data is protected during storage directly influences how long you can safely and legally keep it. Strong encryption with proper key management reduces the risk of keeping sensitive data longer than intended, and many governance frameworks embed this protection into retention requirements, so the retention period is effectively guided by how data is secured while stored. In short, safeguarding stored data through encryption sets the practical boundaries for retention decisions. The other statements are less accurate because retention is not defined solely by the time window, encryption does not by itself establish the retention duration, retention is not the same as encryption, and retention policies are not inherently vendor-specific.