Society For Human Resource Management (SHRM) Certified Professional Practice Exam

What should you do according to the law when a record has expired?

1. Save it in a secure file

2. Destroy it

3. Give it to the person that the record is for

4. Add to a different record for the same person

The correct answer is: Destroy it

When a record has expired, the appropriate action according to the law is to destroy it. This is rooted in various data protection and privacy regulations, which mandate that organizations must not keep personal data for longer than necessary. Retaining expired records can lead to potential legal liabilities and breaches of confidentiality, as it increases the risk of unauthorized access or misuse of outdated information. Moreover, certain laws, such as the General Data Protection Regulation (GDPR) in the European Union, specify that individuals have the right to have their personal data erased when it is no longer needed for the purpose for which it was collected. Therefore, the responsibility lies with organizations to ensure they have proper data retention and destruction policies in place, ensuring compliance and protecting individuals’ privacy rights. The other options may lead to non-compliance: saving records in a secure file might inadvertently prolong their retention, while giving records to individuals could violate confidentiality agreements or legal protections. Adding to another record could also create confusion and further retention issues. Thus, destruction of expired records is the legal and ethical course of action.