Which of the following needs to be identified FIRST to define the privacy requirements to use when assessing the selection of IT systems?

Question

Options

• AType of data being processed
• BApplicable privacy legislation
• CApplicable control frameworks
• DAvailable technology platforms

• A
  4% (2)
• B
  88% (49)
• C
  7% (4)
• D
  2% (1)

Explanation

Privacy legislation defines the mandatory, legally enforceable minimum requirements an organization must meet when processing personal data. Identifying applicable laws and regulations (e.g., GDPR, HIPAA, CCPA) must come first because they establish the non-negotiable baseline obligations-lawful basis for processing, data subject rights, retention limits, breach notification, etc.-that all subsequent decisions must satisfy. The type of data being processed (A) informs which regulations apply but cannot be used meaningfully until the legal context is known. Control frameworks (C) and technology platforms (D) are chosen and configured after legal requirements are understood, since they are the means to achieve compliance, not the driver of it.

No community discussion yet for this question.