What is a potential risk of not having a data retention policy in a vendor relationship?

• A. Legal compliance risk and data minimization challenges
• B. Improved data sharing
• C. Lower governance requirements
• D. Faster onboarding

Answer: (A)

Not having a data retention policy in a vendor relationship opens you up to legal and regulatory risks because data may be kept longer than allowed and deleted too late, or kept without a clear purpose. A retention policy provides the rules for how long data should be kept, when it should be deleted, and how it should be disposed of, which is essential for demonstrating compliance with privacy laws and industry regulations. Without it, you and the vendor may struggle to prove you’re not retaining data beyond what’s legally permissible, increasing the chance of penalties, audits, and reputational harm. It also makes data minimization harder—holding onto data you don’t need adds unnecessary exposure and complicates lawful deletion requests.

Those other outcomes aren’t the real risk described by missing a retention policy. Improved data sharing, lower governance requirements, or faster onboarding aren’t direct risks tied to lacking a retention framework and, in practice, the absence of policy tends to create more governance burdens and potential compliance issues rather than produce those benefits.