When should a CFP implement data retention and secure destruction of confidential client information?

• A. Never delete data.
• B. In line with retention policy and legal requirements; securely delete or anonymize when no longer needed or upon request.
• C. Delete immediately after client ends the relationship.
• D. Delete only upon client request.

Answer: (B)

The main idea is that handling client information responsibly means following a formal retention policy that reflects legal and regulatory requirements. A CFP should keep records for the period specified by that policy and applicable laws, and then securely delete or anonymize them when they’re no longer needed or when a client requests destruction, provided doing so doesn’t conflict with ongoing compliance, audits, or legal holds. This approach protects confidentiality while avoiding keeping data longer than necessary. Data that must be retained by law cannot be destroyed simply because a relationship ends, and retaining everything indefinitely would undermine privacy and security. Conversely, deleting immediately after a relationship ends or only on a client’s request ignores regulatory obligations and the need to preserve records for legitimate purposes.