Which of the following is NOT a best practice for handling consent revocation?

• A. Delete all historical data immediately from every system.
• B. Propagate revocation to all connected systems, enforce policy restrictions, and notify data recipients; audit for completeness.
• C. Notify data recipients of revocation.
• D. Audit for completeness.

Answer: (A)

When handling consent revocation, the goal is to stop further processing and make sure every part of the data-sharing ecosystem respects the withdrawal. The right approach includes propagating the revocation to all connected systems, enforcing the policy restrictions so ongoing processing is blocked, notifying data recipients so they can honor the change, and auditing to confirm the revocation has been implemented across the board. Deleting all historical data immediately from every system is not a best practice because it can destroy important audit trails and violate retention or regulatory requirements. Data that was already legitimately processed or shared may need to be retained for operations or compliance, and revocation typically applies to future processing rather than retroactive deletion unless a separate deletion request is handled under policy. So while revocation should halt future use and alert involved parties, wholesale immediate deletion of historical data isn’t appropriate.