Inventory and classify data types by sensitivity and applicable regulations is the correct initial action when developing a data retention policy.

Inventory and classify data types is the starting point because retention obligations and permissible retention periods depend on the specific data elements and the laws that cover them. You must know which records are personal data, which are protected health information, and which other categories exist before you can map retention periods and controls to GDPR and HIPAA requirements.

Inventory and classification also enable targeted application of technical and administrative controls such as encryption, access controls, and legal holds. Classifying data across all cloud providers lets the organization implement consistent retention rules, prove compliance during audits, and avoid overretention or premature deletion.

Google Cloud Data Loss Prevention is not the best initial action because it is a specific tool for discovering and protecting sensitive data rather than the planning step of identifying what data you hold and which regulations apply. Tool selection comes after you complete an inventory and classification.

Apply legal holds to all sensitive datasets is incorrect because legal holds are a preservation measure used for specific litigation or investigations and they should be applied selectively. Applying holds to everything is not a practical or legally appropriate first step and it can conflict with privacy driven deletion requirements.

Encrypt all records before storing them in the cloud is incorrect because encryption is an important safeguard but it does not replace the need to identify and classify data or to set retention schedules. Encryption alone does not satisfy retention, deletion, or documentation obligations under GDPR and HIPAA.

Full AWS Practitioner Certification Question