AAIA Question of the Day: Data retention controls

Quiz Yazan Ibrahim
AI audit training by expert Yazan Abu Ghosh for auditors with certifications.

AAIA exam practice question — AAIA Question of the Day: Data retention controls

AAIA exam practice question: daily practice for the ISACA Advanced in AI Audit (AAIA) exam — domain: AI Governance and Risk.

Question

An AI audit team discovers that a production model's training dataset contains personal data retained long after the original collection purpose. Which control is the most effective first step to reduce the organization's regulatory and privacy risk related to unnecessary data retention?

  • A. Deploy a documented data retention policy that tags datasets with purpose and retention periods and enforces automated secure deletion when the period expires.
  • B. Pseudonymize personal identifiers in training datasets and continue storing the full datasets in the secured data lake for reproducibility.
  • C. Perform annual access reviews for all training datasets and require manual deletion requests when data reach their expected retention age.
  • D. Encrypt all training datasets at rest with strong keys and retain archived copies until the model is formally retired.
Show the answer and explanation

Correct answer: A. Deploy a documented data retention policy that tags datasets with purpose and retention periods and enforces automated secure deletion when the period expires.

Implementing a documented retention policy with dataset-level tagging and automated secure deletion directly addresses unnecessary retention by removing data when its legal or business purpose ends. This control enforces minimization and reduces exposure. Pseudonymization (option 2) reduces identifiability but does not eliminate the risk of retaining data beyond purpose and can still be subject to retention rules. Annual access reviews with manual deletion (option 3) are weaker operationally; they rely on human action and can leave expired data in place for long periods. Encryption (option 4) protects confidentiality but does not mitigate the compliance risk from keeping data longer than allowed.

Want more practice?

Prepare for the ISACA Advanced in AI Audit (AAIA) exam with AI Audit & Compliance Framework: Practical Methods & Evaluation.