Which of the following is NOT a valid basis for data retention?

The size of the data is not a valid basis for data retention. Data retention policies should be based on factors like the type of data, its location, and the last time it was accessed, rather than its size. Retention decisions should consider the necessity and relevance of the data for legal, operational, and regulatory purposes. This principle is covered in the IAPP’s CIPT materials, specifically in the sections on data lifecycle management and retention policies.