Domain 2 · Objective reference 2.4 · Chapter 16 of 62
Manage collection, use, retention and destruction
About 5 minutes · Current ISC2 outline effective 15 April 2024; the announced 15 April 2027 replacement requires separate mapping
Session only. Enable saving or download a backup from this course’s hub.
Completion is self-reported and does not certify understanding.
See it · Try it · Recall it
Picture the topic
Remember this: Collect only what you can justify and retain only as required.
Explore the anchors
Establish purpose and permitted data.
Concept matching activity
Match this task or description to its concept:
Apply authorized processing and retention.
Choose a concept before checking the explanation.
A quick way to study this topic
- Hide the explanation and redraw these three anchors from memory.
- Explain the difference between the anchors in your own words.
- Apply the distinction to the worked example below. Check the full lesson for assumptions and exceptions.
- Recall it again tomorrow, then after a few days. A memory hint is a retrieval cue, not a replacement for understanding.
Original academy illustrations and fictional exercises. These are learning simulations, not a real virtual machine, network assessment or measure of job readiness. Activities reset when you leave or reload; they do not change quiz scores.
What this chapter explains
- Concepts and mechanisms
- Design, evidence and tradeoffs
- Separate roles and lifecycle evidence
Concepts and mechanisms
The information lifecycle includes collection, storage, use, sharing, maintenance, retention and disposition. Roles such as controller, processor, custodian and information owner depend on the context and applicable definitions; they are not interchangeable labels. Collection should have an approved purpose, and retention should reflect that purpose and applicable duties rather than indefinite convenience.
Design, evidence and tradeoffs
Follow exports, logs, backups and supplier copies. A deletion request can interact with a legal hold or mandatory retention, requiring authorized interpretation. Logical deletion may leave remanent data. Sanitization depends on medium and intended reuse; cryptographic erasure depends on proper encryption and removal of every usable relevant key. Document disposition and how restored backups will be handled.
Separate roles and lifecycle evidence
An owner sets appropriate business handling requirements; a custodian operates assigned safeguards. Controllers determine relevant processing purposes and means under applicable privacy concepts, while processors act within the relevant arrangement; exact legal roles depend on the context. Subjects are people described by personal data, not automatically system administrators. Map collection, location, use, sharing, maintenance, retention and destruction, including copies and derived datasets. Retention requirements and legal holds can constrain deletion, while data remanence requires appropriate sanitization of media and replicas.
Worked example
A customer record is removed from the application, but the team also evaluates support exports and backup restoration behavior before claiming completion.
Check your understanding
Why does deleting the main table row not establish full lifecycle disposition?
Show explanation
Copies, retained obligations and recoverable storage can remain outside that operation.
Source and study boundary
Official syllabus source. The reference identifies the topic being taught. Explanations and examples are original academy material; a topic link does not establish independent approval or sufficient exam mastery.