Which statement best describes data retention for DEOCS results?

• A. Data should be retained indefinitely.
• B. Data should be retained only as long as needed for immediate reports.
• C. Data should be retained for at least a decade.
• D. Retention limits should be defined, and data should be destroyed when no longer needed.

Answer: (D)

The main idea here is establishing a responsible data retention policy for DEOCS results that protects privacy and reduces risk. DEOCS data can contain sensitive information about individuals and units, so keeping it longer than necessary increases the chances of unauthorized access, misuse, or data breaches, and adds unnecessary data management burdens. The best approach is to define clear retention limits and destroy the data when it’s no longer needed for reporting or analysis. This reflects data minimization and risk management principles, ensuring the information remains useful for legitimate purposes without exposing people to ongoing risk. Keeping data indefinitely, or only for immediate reports, or for an extended fixed period like a decade, either overexposes or limits usefulness, whereas a defined, need-based destruction timeline balances utility with privacy and security.