A healthcare-related AI application needs a retention and deletion policy for input and output logs.
Keep evidence needed for audits but do not keep personal data indefinitely.
Which policy is appropriate?
Define retention, access, deletion, and exception procedures from legal, contractual, audit, and privacy requirements.
Detailed explanation
Required evidence could be lost.
The policy preserves necessary evidence while removing data after its purpose ends.
Temperature is an inference setting, not a retention control.
This is excessive retention and weak access control.
Check official documentation
Compare the following points with the official documentation.
AWS公式AIF-C01ガイドのDomain 5.2とAWSログ・データ保持の公式説明を確認する。
Official references
What to confirm
保持期間を無期限・一律で決めず、要件とデータ最小化を両立する説明ができる。
Key points
- Retention
- Deletion
- Audit
Notes
- Environment: AWS公式AIF-C01試験ガイドとAWS公式ドキュメントの確認
- Compare the definition with the AIF-C01 objective and the service documentation before applying it.
- Keep the concept separate from a particular answer choice or implementation step.
Foundation review
Purpose limitation
Logs should be retained for defined operational, security, legal, or compliance purposes.
Deletion evidence
A retention process should record what was deleted, when, by which rule, and with what exceptions.