What is a data retention policy in third-party risk management (TPRM)?

• A. Policy specifying how long data may be kept by the vendor and customer
• B. Policy requiring data to be kept indefinitely
• C. Policy on how to delete vendor emails
• D. Policy on employee training frequency

Answer: (A)

A data retention policy in third-party risk management defines how long data may be kept by both the vendor and the customer, and how it is stored, protected, and eventually disposed of. This focus on the data’s lifecycle is essential because it directly governs compliance with privacy laws, contractual obligations, and audit or regulatory requirements, while also guiding secure deletion and transitions when relationships end. In a TPRM program, having clear retention rules helps limit exposure by avoiding unnecessary data storage and ensuring proper handling across the vendor ecosystem. The other ideas miss the scope because keeping data indefinitely ignores privacy and regulatory limits, deleting only vendor emails is too narrow to cover all data types, and training frequency has no direct bearing on how data is retained.