Security and privacy

Hi Stefan

just a quick answer below the lines to your questions:

• What happens after the retention period passes?
  You'll get an overview about elements to delete and start deletion manually.
  
  • What gets deleted? Does only user data get deleted (like what "reset course" does), or do whole activities / blocks / courses get deleted?
    Only user data. Course contents are not deleted.
    
  • How can an admin confirm/avoid those deletions?
    Not confirming the deletion. Or defining no retention period for specila courses, categories  or not setting a course end date.
    
• Is there any way to set different retention periods for different types of activities (forums, quizzes, etc)?, without choosing a category for each single activity of that kind?
  No, not on activity type level.  This willbe an improvement
  
• What date determines when the retention period expires?
  Course end data in course settings
  
  • Say i set a retention period of 6 months for a whole course - will the course be deleted 6 months after it is created?
    No, only user data if you confirm data deletion.
    
  • Or if only user data gets deleted: do forum posts get deleted 6 months after they were being made, or 6 months after the forum itself was created? what happens to child posts of deleted topics?
    The retention period is for complete course user data. The calculation is based on course enddate plus  six months of retention.
    Its different if a user asks for account and data deletion. If the protection is not set the data forthe user incl. forum post content will be deleted. Child content will stay.