Which statement best reflects a company responsibility about data?

Which statement best reflects a company responsibility about data?

• A. Must delete data that is no longer needed but encryption is optional
• B. They should share data with third parties if it benefits them
• C. There is no obligation to encrypt stored data
• D. Must delete data that is no longer needed and protect data users using encryption

Answer: (D)

The main idea is that organizations have a duty to protect data by reducing what they keep and securing what they hold. Deleting data that’s no longer needed minimizes the amount of information that could be exposed if a breach occurs, while encryption protects data from unauthorized access both when it’s stored (at rest) and when it’s being used or transmitted. The statement that combines these two protections best reflects responsible data handling. Other options fall short because encryption isn’t optional if the goal is strong protection, sharing data with third parties without safeguards or consent isn’t a blanket responsibility, and there is indeed an obligation to encrypt stored data as part of good security practices.

The main idea is that organizations have a duty to protect data by reducing what they keep and securing what they hold. Deleting data that’s no longer needed minimizes the amount of information that could be exposed if a breach occurs, while encryption protects data from unauthorized access both when it’s stored (at rest) and when it’s being used or transmitted. The statement that combines these two protections best reflects responsible data handling.

Other options fall short because encryption isn’t optional if the goal is strong protection, sharing data with third parties without safeguards or consent isn’t a blanket responsibility, and there is indeed an obligation to encrypt stored data as part of good security practices.