Which practice is NOT part of privacy and PII handling in CX data usage?

• A. Data minimization
• B. Consent management
• C. Encryption
• D. Data retention without consent

Answer: (D)

The main idea here is how privacy and PII handling guide CX data usage. Keeping data usage aligned with privacy means minimizing what you collect, securing it, and having proper permission to process it. Data minimization means you only gather what's truly necessary to deliver the service. Consent management ensures you obtain and track user permission before processing their data. Encryption protects data at rest and in transit, preventing unauthorized access. In contrast, retaining personal data without consent runs counter to privacy principles—data should not be kept beyond its stated purpose or without a legitimate basis and proper authorization. Retention without consent undermines user control and compliance, so it is not part of proper privacy and PII handling.