Which of the following is MOST likely to present a valid use case for keeping a customer’s personal data after contract termination?

The principle of storage limitation dictates that personal data should not be kept longer than necessary for the purposes for which it was processed. After a contract terminates, the original purpose is fulfilled. However, a separate legal obligation, such as tax laws, anti-money laundering regulations, or industry-specific statutes, can provide a new, valid lawful basis for retaining the data for a specified period. This is a common and legitimate reason that overrides the data subject's right to erasure. The retention is not for a new business purpose but for compliance with the law.

A. Medical research would require a new, specific legal basis, such as explicit consent, and is not an automatic right after contract termination.
B. A win-back campaign is a new marketing purpose that requires fresh consent; it is not a valid reason for retention without permission.
D. Ease of onboarding is a business convenience, not a legal basis for data retention, and it infringes on the principle of data minimization.

1. European Parliament and Council of the European Union. (2016). Regulation (EU) 2016/679 (General Data Protection Regulation - GDPR). Article 5(1)(e) establishes the "storage limitation" principle. Article 6(1)(c) provides a lawful basis for processing that is "necessary for compliance with a legal obligation to which the controller is subject."

2. ISACA. (2021). CDPSE Review Manual. Domain 2: Data Lifecycle. The section on data retention policies explicitly states that retention periods must be defined based on business needs, legal, and regulatory requirements.

3. NIST. (2020). NIST Privacy Framework: A Tool for Improving Privacy through Enterprise Risk Management, Version 1.0. Core Function: Protect-P (PR.P), Category: Data-in-Transit Protection (P7). Subcategory PR.P7-3 states, "Data are retained consistent with data retention policies," which are informed by legal obligations.