To minimize privacy risk when collecting data, which practice is best?

• A. Retain indefinitely
• B. Share data widely
• C. Collect data you don't need
• D. Store data only as long as necessary

Answer: (D)

Storing data only as long as necessary minimizes privacy risk by limiting the time data is at risk of exposure or misuse. When data sits around, it creates more opportunities for unauthorized access, breaches, or policy violations. Establishing retention periods and deleting data once it’s no longer needed reduces both the chance of an incident and the potential impact if one were to occur. It also supports privacy-by-design practices: collect what you truly need for a defined purpose, and discard it when that purpose is fulfilled. For example, keep customer contact information only for the duration of a transaction unless there’s a legitimate reason to retain it longer.

Keeping data indefinitely, sharing data broadly, or collecting data you don’t need all increase privacy risk, so they’re not as effective for minimizing exposure.