Verify the retention exception and process the rights: What should it do first?
The insurer must reconcile the erasure request with any applicable legal retention exception, rather than deleting or retaining records automatically.
The question
Under the EU GDPR, an insurer receives an erasure request for records used by an underwriting model. Its retention schedule is incomplete, and some records may be needed for a documented legal obligation. What should it do first?
Preparing for AIGP? Take the free 5-min readiness quiz →
- Retain every record until the underwriting model is retired.Indefinite retention conflicts with storage limitation unless a specific legal or other justified basis supports the period.
- Delete all requested records immediately from model storage.Immediate deletion may breach a documented legal retention obligation and ignores the requirement to assess applicable rights exceptions.
- Verify the retention exception and process the rights request under procedure. ✓The insurer must examine whether a legal retention exception applies while handling the request through its documented rights process.
- Ask the model supplier to decide whether erasure applies.The insurer remains responsible for rights handling and cannot delegate the legal determination merely because a supplier operates the model.
The trap
When rights and retention conflict, verify the specific exception first; neither automatic deletion nor indefinite retention is defensible. How to remember it
The insurer must reconcile the erasure request with any applicable legal retention exception, rather than deleting or retaining records automatically.
How many of these would you get right?
One of 1581 AIGP questions on Certsqill. Take a free five-minute check and see your score per domain — not one number, but which section to open tonight.
Test your AIGP readiness — freeMore Understanding How Laws, Standards and Frameworks Apply to AI questions
- Documented adequacy or Chapter V safeguards: What evidence is missing? →
- Document an applicable lawful basis for the training: Which direct control is still missing? →
- Assess compatibility between the original and proposed: What missing control is most direct? →
- All 394 Understanding How Laws, Standards and Frameworks Apply to AI questions →
Part of the Certsqill AIGP question bank · Understanding How Laws, Standards and Frameworks Apply to AI ·
Every answer, right and wrong, comes with its own explanation.