Which policy determines how long data should be retained in FOSSE?

• A. Data Retention Policy
• B. Data Masking Policy
• C. Access Control Policy
• D. Data Minimization Policy

Answer: (A)

Data retention is about how long information should be kept and when it should be archived or deleted. In FOSSE, the Data Retention Policy specifies the retention periods for different data types, accounts for legal and regulatory requirements, and defines the schedules for archiving or disposing of data. It guides lifecycle decisions so data isn’t kept longer than needed and supports audits and governance. Other policies address different concerns—data masking dictates how sensitive data is obscured in non-production environments, access control governs who can access data, and data minimization focuses on collecting only what’s necessary. While all are important for security and privacy, they don’t determine how long data should be retained—that’s the job of the retention policy.