What is the recommended approach when a client requests deletion of their data?

• A. Refuse to delete due to retention policy.
• B. Review retention policy and legal requirements, securely delete or anonymize if allowed, and document.
• C. Delete immediately without verification.
• D. Transfer to another client.

Answer: (B)

Handling a data deletion request hinges on privacy and compliance: you must balance the client's right to have their data removed with any legal or policy obligations to retain records. The best approach is to first review the firm’s data retention policy and any applicable laws to determine what data must be kept and for how long. If the data can be deleted lawfully, you securely delete it or anonymize it to remove identifiable links while still preserving any records required for compliance, and you document exactly what was done, when, and by whom. This creates a clear audit trail and shows you acted deliberately and in accordance with policy and law. If deletion isn’t permitted, you explain why and discuss allowed alternatives, such as partial deletion or anonymization, with documentation. The other options fail because refusing without considering policy ignores privacy rights and compliance, deleting without verification risks violating retention obligations or data integrity, and transferring data to another client would breach confidentiality and proper data handling.