What are key data security practices when handling victim information?

• A. Unlimited data access for all officers.
• B. Access controls, encryption, secure storage, limited retention, audit trails, training on privacy.
• C. No retention of records to protect privacy is the only requirement.
• D. Sharing data publicly to increase transparency.

Answer: (B)

The main concept is protecting victim information through layered security controls and privacy-minded practices that govern who can access data, how it is stored, and how long it is kept. Access controls ensure only authorized personnel with a legitimate need can view or handle the data, using least privilege and strong authentication. Encryption keeps data unreadable both when it is stored and when it’s transmitted, so exposure doesn’t reveal sensitive details. Secure storage covers proper protection of databases, devices, backups, and any physical or cloud infrastructure where data resides. Limited retention means keeping data only as long as necessary for legitimate purposes, with clear retention schedules and secure destruction when it’s no longer needed. Audit trails record who accessed data and when, supporting accountability, detection of misuse, and compliance. Training on privacy equips staff with the knowledge of how to handle information responsibly, recognizing consent requirements, data minimization, and incident reporting.

Choosing any option that allows unrestricted data access, omits retention controls, or shares data publicly would undermine confidentiality and increase risk to victims.