Regulated Data and Retention Requirements for A+
Short answer
Technicians should identify regulated data when encountered and apply appropriate handling: avoid unnecessary duplication, store in approved encrypted locations, follow retention schedules, and observe legal holds. When a user requests deletion or access to regulated data, escalate to the data protection officer or legal if the request might conflict with retention or legal-hold obligations.
Why it appears on the exam
- Given a data sample, identify whether it is PII, payment card data, or healthcare data and state the immediate handling step. - Choose the correct escalation step when a deletion request conflicts with a retention policy or legal hold.
Key concepts
Concept 1
Required terms
PII (Personally Identifiable Information): Information that can be used to uniquely identify, contact, or locate a person (names linked with identifying data such as SSN, DOB, address). payment card data: Information related to payment cards, including cardholder name, PAN (primary account number), expiration date, and service code; protected under standards such as PCI-DSS. healthcare data: Protected health information that relates to an individual's health status or healthcare payment, subject to specific protection requirements (e.g., HIPAA in the US). data retention requirements: Organizational or regulatory rules defining how long certain data must be kept and when it must be disposed of.
Example
Example 1: Backup contains customer payment card data. Technician quarantines the backup, notifies security/procurement, and follows PCI-DSS handling steps per company policy.
Concept 2
How Regulated Data and Retention Requirements works
Technicians should identify regulated data when encountered and apply appropriate handling: avoid unnecessary duplication, store in approved encrypted locations, follow retention schedules, and observe legal holds. When a user requests deletion or access to regulated data, escalate to the data protection officer or legal if the request might conflict with retention or legal-hold obligations.
Example
Example 2: A user asks to delete a record that may be under legal hold; technician documents the request and routes to legal/data protection rather than deleting.
Concept 3
Common confusion
- "If the user requests it, delete it immediately": Retention schedules and legal holds can prevent deletion; always verify policy before removing regulated data. - "Redacted logs are always safe": Redaction must be sufficient and follow policy; partial or reversible redaction can still expose regulated data.
Example
Example 1: Backup contains customer payment card data. Technician quarantines the backup, notifies security/procurement, and follows PCI-DSS handling steps per company policy.
Concept 4
Core 2 (220-1202) question cues
Given a data sample, identify whether it is PII, payment card data, or healthcare data and state the immediate handling step; Choose the correct escalation step when a deletion request conflicts with a retention policy or legal hold.
Example
Example 2: A user asks to delete a record that may be under legal hold; technician documents the request and routes to legal/data protection rather than deleting.
Sample questions
Select an answer to reveal the explanation. For tracked practice and weak-area review, use the Cultiv8 app.
Q1.An A+ support scenario describes this situation: Example 1: Backup contains customer payment card data. Technician quarantines the backup, notifies security/procurement, and follows PCI-DSS handling steps per company policy. Which answer fits best?
Q2.For this A+ objective, the scenario says: Example 1: Backup contains customer payment card data. Technician quarantines the backup, notifies security/procurement, and follows PCI-DSS handling steps per company policy. What is the best match?
Q3.A user reports this support situation: Protected health information that relates to an individual's health status or healthcare payment, subject to specific protection requirements (e.g., HIPAA in the US). Which option should the technician choose?
Practice this lesson in Cultiv8
The app adds tracked practice, targeted remediation, saved session history, and future readiness scoring.
Continue in Cultiv8