What is data retention in CPPA?

• A. Retaining pay records per DoD policy for a specified period.
• B. Deleting all pay records after 1 year.
• C. Archiving only after litigation holds.
• D. Keeping records indefinitely without policy.

Answer: (A)

Data retention refers to how long an organization keeps records and the policy that defines that timeframe. In CPPA practice, keeping pay records for a defined period per DoD policy means there is a specific retention schedule that tells you how long each type of data must be kept, and when it should be deleted or archived. This approach ensures you can meet audits, support responses to inquiries, and comply with legal and regulatory requirements, rather than keeping data indefinitely or discarding it too soon.

Archiving or deletion decisions are driven by that policy, not by a one-size-fits-all rule. For example, data may be retained for a set number of years, then securely destroyed, or moved to an archive according to the schedule. Holds during litigation or investigations can temporarily override normal retention, but the fundamental concept is still a policy-defined, time-bound approach to data retention.