A data retention policy is a policy that governs how long data should be kept and when it should be destroyed. This helps organizations to comply with legal and regulatory requirements and to manage their data more effectively. Therefore, option a is the correct answer.