Question

A privacy engineer is designing retention rules for a customer loyalty program. The marketing team wants to keep all transaction and profile data indefinitely 'in case it's useful later.' Legal requires financial records be kept 7 years, and the program's stated purpose is delivering rewards based on the last 24 months of activity. What is the BEST approach to defining the retention schedule?

Accepted Answer

Set retention periods per data category tied to the specific purpose each category serves, applying the longest legally required period only to data with a binding legal obligation

Answer

Adopt a single organization-wide retention period of 7 years for all loyalty data to simplify enforcement and satisfy the legal requirement

Answer

Retain all data indefinitely but restrict marketing access to records older than 24 months to honor the program purpose

Answer

Delete all loyalty data after 24 months since that is the program's stated operational purpose