- How long should my company keep its data?

First, you need to determine what regulations, laws or standards that your organization is addressing in its operations. PCI DSS sets the simplest data retention requirement with 90 days hot and one-year cold storage. New York Department of Financial Services (DFS) has set their standard at three years cold.

- Why or What is a Data Privacy Officer (DPO)?

A Data Privacy Officer is responsible for monitoring how an organization handles data. This includes being the authority on categorizing data and being a point of contact for compliance requirements and privacy.

- What is the difference between hot and cold data? Who cares?

Cold data is considered not immediately searchable. When data is stored for operations, the data should be immediately available for search. Searchable data is considered hot. But storing data in a data structure for searching is expensive and often unnecessary. PCI DSS defines that data should remain hot for a minimum of 90 days. After which, the logs still need to be stored if needed. This long-term not as easily accessible data is referred to as cold.

- How does privacy impact audit compliance?

Privacy creates complexity in the handling of data. While laws require that audit trails be immutable (cannot be deleted), new data privacy laws require that personal identifiers in audit be able to be deleted. When a user's identifying data is to be stored, the audit system stores instead a pseudonym (unique one-way token that acts as a key). The key and related value for that pseudonym are stored in a table that allows deletion. When a user's identity is removed, it is done by deleting the pseudonym key-value. This allows other log data not to be deleted, especially when it contains other pseudonym that are involved in criminal or incorrect activity. Pseudonym are not one-way hashes for the value can be determined by brute force, a mistake that some large audit vendors are making.