Which of the following helps define data retention time in a stream-fed data lake that includes personal data?

Data retention periods are governed by legal, regulatory, and organizational requirements. Data privacy standards, which encompass these requirements (e.g., GDPR's storage limitation principle), provide the authoritative rules for how long personal data should be kept. These standards dictate the policy that is then implemented technically. The definition of retention time is a governance function, not a technical configuration or an outcome of a risk assessment, although assessments may highlight the need for such a policy.

A. Privacy impact assessments (PIAs) identify risks and the need for controls like retention policies but do not define the specific time periods themselves.
B. Data lake configuration is the technical implementation of a retention policy, not the source that defines the policy's time frames.
D. Information security assessments evaluate security controls and risks, which is related but distinct from defining legally-mandated data retention periods.

1. ISACA. (2020). CDPSE Review Manual. Domain 2: Data Governance, Section 2.3.3 Data Retention. This section emphasizes that retention policies are based on legal, statutory, regulatory, and contractual requirements.

2. General Data Protection Regulation (EU) 2016/679. Article 5(1)(e), "Principles relating to processing of personal data," establishes the "storage limitation" principle, a core component of data privacy standards.

3. NIST. (2020). NIST Privacy Framework: A Tool for Improving Privacy through Enterprise Risk Management, Version 1.0. The framework's "Govern-P" function includes developing and implementing policies for data processing, including retention.