Which of the following should be used to address data kept beyond its intended lifespan?

Data minimization is a core privacy principle stating that personal data collected and processed should be adequate, relevant, and limited to what is necessary for the purposes for which it is processed. A key component of this principle is "storage limitation," which dictates that data should not be kept in a form that permits identification of data subjects for longer than is necessary for the purposes for which the personal data are processed. Therefore, applying the principle of data minimization directly addresses the issue of data being retained beyond its intended and legally permissible lifespan by requiring its timely deletion or anonymization.

B. Data anonymization is a technique to remove identifiers, but it does not address the retention period. Anonymized data can still be kept indefinitely.
C. Data security involves protecting data from unauthorized access. It does not define how long data should be kept.
D. Data normalization is a database design technique to reduce redundancy and is unrelated to data retention policies.

1. ISACA, CDPSE Review Manual, 2020, Domain 1: Privacy Governance, Section 1.5 Privacy Principles. This section explicitly links data minimization with the principle of storage limitation.

2. General Data Protection Regulation (GDPR), Regulation (EU) 2016/679, Article 5(1)(c) and 5(1)(e). Article 5(1)(c) defines data minimization, and 5(1)(e) defines the "storage limitation" principle.

3. NIST, NIST Privacy Framework: A Tool for Improving Privacy through Enterprise Risk Management, Version 1.0, January 16, 2020, Section 2.2 Core: Disseminate (P-DS). This section includes subcategories like P-DS-5, which addresses data minimization and retention policies.