Define retention limits and a coordinated workflow: Which missing control most directly addresses both gaps?
The direct control combines storage limitation with an end-to-end workflow for access and erasure across related records.
The question
Under the GDPR in the European Union, a financial-services processor uses AI to extract information from customer documents. The business has no defined deletion point and cannot route access or erasure requests reliably across extracted text, source files, and derived records. Other privacy prerequisites are satisfied. Which missing control most directly addresses both gaps?
Preparing for AIGP? Take the free 5-min readiness quiz →
- Assign one employee to answer customer inquiries informally.An informal owner may help communication, but it does not create retention rules or a traceable rights-handling process.
- Define retention limits and a coordinated workflow for access and erasure requests. ✓Storage limitation requires defined retention, while rights handling requires coordinated lifecycle processes covering source and derived records.
- Set a deletion date for source files while retaining derived records indefinitely.A partial deletion rule leaves uncontrolled derived records and may undermine storage limitation and rights handling.
- Encrypt source documents and extracted text.Encryption protects confidentiality but does not establish retention limits or enable coordinated rights-request handling across records.
The trap
Trace personal data across source, extracted, and derived forms; lifecycle controls must cover each relevant representation. How to remember it
The direct control combines storage limitation with an end-to-end workflow for access and erasure across related records.
How many of these would you get right?
One of 1581 AIGP questions on Certsqill. Take a free five-minute check and see your score per domain — not one number, but which section to open tonight.
Test your AIGP readiness — freeMore Understanding How Laws, Standards and Frameworks Apply to AI questions
- Document the applicable Chapter V safeguard and supporting: Which missing control is most direct? →
- Treat public availability as access evidence: Which interpretation best fits these observations? →
- Assess purpose compatibility and lawful basis before: What should procurement require first? →
- All 394 Understanding How Laws, Standards and Frameworks Apply to AI questions →
Part of the Certsqill AIGP question bank · Understanding How Laws, Standards and Frameworks Apply to AI ·
Every answer, right and wrong, comes with its own explanation.
