How should incident data be stored to ensure privacy and regulatory compliance?

• A. Public shared spreadsheets for ease of access.
• B. Local laptop storage without encryption.
• C. Secure databases with access control, encryption, data minimization, retention schedules, and compliance with data protection laws; anonymization where possible.
• D. Cloud storage with indefinite retention and no access controls.

Answer: (C)

The main idea is to protect privacy and meet legal requirements by controlling who can see data, protecting the data itself, and limiting how long it is kept. Using secure databases with strict access control ensures only authorized personnel can view or modify incident information. Encryption protects data both at rest and in transit, so even if someone gains access, the information remains unreadable. Data minimization reduces the amount of sensitive information stored, lowering exposure risk. Retention schedules ensure data is kept only as long as necessary, helping comply with regulations that require timely disposal of records. Anonymization where possible further reduces privacy risks by removing identifying details, enabling safer analysis and sharing. This approach aligns with data protection laws and standards, supporting accurate investigations while safeguarding individuals’ information. In contrast, public spreadsheets are prone to unintended access, local laptop storage without encryption is vulnerable to loss or theft, and cloud storage with indefinite retention and no access controls leaves data exposed and non-compliant.