How should records be retained and archived to meet regulatory and organizational requirements?

• A. Destroy records immediately after use.
• B. Store records only on local drives.
• C. Keep all records forever.
• D. Retention schedules based on policy; ensure secure storage, accessibility, and timely destruction when permissible.

Answer: (D)

The main idea here is that records should be governed by formal retention schedules that are aligned with organizational policy and regulatory requirements. A well-defined schedule specifies what to keep, for how long, where to store it, and when to dispose of it. This approach ensures records are available for business needs, audits, and legal holds, while also supporting privacy protections and cost-effective storage. Archiving should be used for longer-term preservation of less-active records, but in a way that keeps them secure, searchable, and accessible when needed. Destruction should occur in a timely, secure manner once the retention period ends and there are no legal holds or other obligations preventing it.

Destroying records after every use fails to meet required retention periods and potential legal holds. Storing everything only on local drives is insecure and impractical for scale, backup, and access. Keeping all records forever is unsustainable and unnecessary, potentially violating privacy and data minimization principles.