An IT technician is handling a data privacy request from a European Union resident who requested the complete erasure of their account details under the General Data Protection Regulation (GDPR) right to be forgotten. Which of the following actions should the technician take to properly comply with this regulation? (Select TWO.)
- Permanently delete the user's personally identifiable information (PII) from active production databases.Answer
- Purge or anonymize the user's personal records stored within secondary backup archives.Answer
- CReclassify the customer account details as Protected Health Information (PHI) to restrict future system access.
- DTransfer the user's personal file to an unencrypted archive server to satisfy PCI-DSS audit standards.
Answer
The correct actions are permanently deleting the user's personally identifiable information (PII) from active production databases and purging or anonymizing the user's personal records stored within secondary backup archives.
The General Data Protection Regulation (GDPR) mandates that when an individual exercises their right to be forgotten, the organization must remove their personally identifiable information (PII) from active production environments as well as sanitize or remove it from backup media.
Step-by-Step Solution
Key Concept
GDPR Data Erasure and PII Handling