Which element is NOT typically included in a data retention policy?

Which element is NOT typically included in a data retention policy?

• A. Encryption algorithm used for data at rest.
• B. How long data is kept, when it can be deleted, and archival/custodian responsibilities.
• C. Archival processes.
• D. Data access controls.

Answer: (A)

Data retention policies govern the lifecycle of information—how long data is kept, when it can be deleted, and who is responsible for archiving or custodian duties, as well as how archived data is processed and accessed. These elements ensure that records are managed consistently from creation through destruction, with clear responsibilities and processes for retrieval or disposal. Encryption details, such as which algorithm protects data at rest, belong to data protection or security policies rather than to retention governance; they describe safeguards rather than the data’s lifecycle or retention timelines. Because of this, the encryption algorithm used for data at rest is not typically included in a data retention policy.

Data retention policies govern the lifecycle of information—how long data is kept, when it can be deleted, and who is responsible for archiving or custodian duties, as well as how archived data is processed and accessed. These elements ensure that records are managed consistently from creation through destruction, with clear responsibilities and processes for retrieval or disposal. Encryption details, such as which algorithm protects data at rest, belong to data protection or security policies rather than to retention governance; they describe safeguards rather than the data’s lifecycle or retention timelines. Because of this, the encryption algorithm used for data at rest is not typically included in a data retention policy.