Which data retention practice complies with the General Data Protection Regulation (GDPR)?

Under the General Data Protection Regulation (GDPR), organizations are required to store personal data only for as long as necessary and must securely erase or anonymize data once it is no longer needed for its original purpose.

This aligns with GDPR’s "Storage Limitation Principle" (Article 5(1)(e)), which mandates that data should be:

Kept only for as long as necessary for processing purposes

Deleted or anonymized when no longer required

Stored securely to prevent unauthorized access

GDPR Compliance (Article 5: Principles of Processing Personal Data) – Enforces storage limitation and secure erasure.

Data Ethics (Fair and Responsible Use of Personal Data) – Ethical obligation to limit storage and prevent misuse.

Privacy by Design (Cavoukian, 1995) – Encourages secure deletion of unnecessary data.

Utilitarian Ethics & Data Protection – Secure erasure prevents potential misuse and data breaches.

Relevant Ethical References in Technology:Thus, the correct answer is D. Securely erasing data that is no longer needed, as it complies with GDPR storage limitation requirements.