Which of the following is NOT a valid basis for data retention?

A data retention policy must be based on justifiable criteria, typically derived from legal, regulatory, contractual, or legitimate business requirements. The size of the data is an operational metric related to storage capacity and cost, not a valid legal or business justification for either keeping or deleting data. Retention decisions are driven by the data's content, context, and applicable obligations. For instance, tax records must be kept for a specific number of years regardless of whether they are a few kilobytes or many gigabytes in size.

B. Type of the data. - This is a primary basis for retention, as different data types (e.g., financial, medical, HR) are subject to different laws and business rules.
C. Location of the data. - The jurisdiction where data is stored or processed dictates which laws apply, making location a critical factor in determining retention periods.
D. Last time the data was accessed. - This is a valid basis for business-driven retention; data that is no longer accessed may have lost its business value, triggering its disposal.

1. National Institute of Standards and Technology (NIST). (2021). NIST Special Publication 800-88 Revision 1: Guidelines for Media Sanitization. Section 2.2, "Information Life Cycle," discusses the phases of data life, where the "Store/Use" phase is governed by retention policies. These policies are based on legal and business needs, not data volume.

2. ISO/IEC 27001:2013. Information technology — Security techniques — Information security management systems — Requirements. Annex A, Control A.18.1.3 ("Protection of records"), requires records to be protected according to legal, statutory, regulatory, and contractual requirements, which define the retention basis.

3. Smallwood, R. F. (Ed.). (2013). Information governance: Concepts, strategies, and best practices. John Wiley & Sons. Chapter 3, "The Information Governance Model," details that retention schedules are based on record type, regulatory requirements, and business need, not physical attributes like size.