Which of the following is MOST likely to present a valid use case for keeping a customer’s personal data after contract termination?

Data retention is a process of keeping personal data for a specified period of time for legitimate

purposes, such as legal obligations, contractual agreements, business operations or historical

records. Data retention should be based on the principle of data minimization, which requires

limiting the collection, storage and processing of personal data to what is necessary and relevant for

the intended purposes. Data retention should also comply with the principle of storage limitation,

which requires deleting or disposing of personal data when it is no longer needed or justified. The

most likely valid use case for keeping a customer’s personal data after contract termination is a

required retention period due to regulations, such as tax laws, financial laws, health laws or

consumer protection laws, that mandate the organization to retain certain types of customer data for

a certain period of time after the end of the contractual relationship. The other options are not valid

use cases for keeping a customer’s personal data after contract termination, as they do not meet the

criteria of necessity, relevance or justification. For the purpose of medical research, the organization

would need to obtain the consent of the customer or have another legal basis for processing their

personal data for a different purpose than the original contract. A forthcoming campaign to win back

customers or ease of onboarding when the customer returns are not legitimate purposes for

retaining customer data after contract termination, as they are not related to the original contract

and may violate the customer’s privacy rights and p

. , p. 99-100 Reference: : CDPSE Review

Manual (Digital Version)