All RE5 questions
POPIA Data Protection Record Keeping
A former client asks an FSP to delete all the personal information it holds about her. Her policy ended two years ago. She says POPIA gives her the right to have it erased at once, and threatens to complain to the Information Regulator if the FSP refuses. What must the FSP do?
RE5 practice question with a worked answer. This is one of hundreds of FSCA RE5 questions in the RegulatoryExams question bank.
- a) Keep the FAIS records for five years after the cover stopped; destroy the rest.Correct
- b) Erase everything at once, because her request overrides every other law.
- c) Refuse, because information a client has given may be kept indefinitely.
- d) Erase all but her contact details, which it may keep in order to market to her.
Why this is the answer
POPIA allows information to be kept longer than its purpose requires where another law requires it. FAIS requires records to be kept for five years after the product ends, so those must be kept until then. Information the FSP no longer needs and is not required to keep must be destroyed or de-identified. Keeping her details for marketing would need a lawful basis of its own.
Want to test yourself on 700+ more questions like this?
Start your free RE5 simulator today — timed mock exams, full answer explanations and cloud-synced progress tracking.