CompTIA CASP+ Practice Test

How many years of email data must a company legally provide in response to an e-discovery request if their policy only requires one year?

1. 1 year

2. 3 years

3. 5 years

4. None

The correct answer is: 5 years

In the context of e-discovery requests, companies are often subject to various legal and regulatory frameworks that may dictate how long they must retain certain types of data, including email communications. When a company has a policy that requires only one year of data retention, it may not necessarily mean that they can limit their disclosure to just that time frame when faced with e-discovery. If the organization is under specific regulations that mandate longer retention periods—like Sarbanes-Oxley or HIPAA—they may have to provide data that extends beyond their internal policy. In certain instances, if the subject of the e-discovery request pertains to ongoing investigations or litigation, the company might be required to retain and provide data from as far back as three years or even longer, depending on the circumstances surrounding the case. The correct answer reflects the legal obligation that can supersede the internal policy, indicating that while the company has a one-year retention policy, the legal requirements could dictate up to three years of data must be provided for compliance with e-discovery requests. This emphasizes the significance of understanding legal regulations that govern data retention and e-discovery, as they can impose requirements that companies must follow regardless of their own policies.