Skip to content

ACCA Applied Knowledge · Business and Technology · Regulation and financial crime

A retailer holds customer names and addresses to process online orders. Under typical data protection principles, such as those in the GDPR, which of the following is the retailer's obligation?

The retailer must collect and use personal data only for specified, legitimate purposes and keep it no longer than necessary. Indefinite retention for possible future use, or free sharing with other companies, would breach the principles of purpose limitation and storage limitation.

  1. AKeep the data indefinitely in case it is useful for future marketing
  2. BCollect and use the data only for specified, legitimate purposes and keep it no longer than necessaryCorrect
  3. CShare the data freely with group companies since the customers have bought from the retailer

Explanation

Data protection principles require purpose limitation and storage limitation: personal data is collected for specified purposes and retained only as long as needed. Indefinite retention breaches storage limitation. Free sharing breaches purpose limitation and lawful processing requirements.

Did you get it right without looking?

One question tells you little. A timed set on Regulation and financial crime shows your real accuracy, how long you take and where you lose marks.

More Regulation and financial crime questions