An organization is creating a personal data processing register to document actions taken with personal dat a. Which of the following categories should document controls relating to periods of retention for personal data?

A personal data processing register documents the entire data lifecycle. Data retention periods define how long data is kept before it is either securely destroyed or moved into long-term, inactive storage, which is known as archiving. Therefore, controls relating to retention periods are most appropriately documented under the "Data archiving" category. This category specifically addresses the final, active stages of the data lifecycle, governing when data is removed from operational systems and how long it is preserved in an archive before final disposition, directly reflecting the implementation of retention policies.

B. Data storage: This is a general category describing where data resides. Archiving is a specific type of storage and process tied directly to retention and disposition policies.
C. Data acquisition: This is the beginning of the data lifecycle (collecting data). Retention policies apply at the end of the lifecycle, not at the point of acquisition.
D. Data input: This refers to the act of entering data into a system. It is an initial processing step, whereas retention governs the final stages of the data's life.

1. ISACA, CDPSE Review Manual, 2020, Domain 2: Data Lifecycle, Section 2.5 Data Retention and Destruction. This section links retention policies directly to the end-of-life processes, including archiving and destruction.

2. General Data Protection Regulation (EU) 2016/679, Article 30(1)(f). This article requires the record of processing activities to include, where possible, "the envisaged time limits for erasure of the different categories of data," which is the core of a retention policy.

3. ISO/IEC 27701:2019, Clause 7.4.8 "Personal information disposal." This control requires that procedures be in place for the disposal of PII on storage media, which is dictated by retention periods and often involves an archiving phase before final deletion.