Which of the following should FIRST be established before a privacy office starts to develop a data protection and privacy awareness campaign?

Question

Options

• ADetailed documentation of data privacy processes
• BStrategic goals of the organization
• CContract requirements for independent oversight
• DBusiness objectives of senior leaders

• A
  4% (1)
• B
  92% (23)
• C
  4% (1)

Explanation

Strategic goals must come first because an awareness campaign needs to align with where the organization is headed - without knowing the mission and strategic direction, any campaign risks being misaligned, redundant, or ineffective. You build campaigns in service of strategy, not the other way around.

• A (Detailed documentation of data privacy processes) is a downstream artifact - you document processes after you know what you're trying to achieve, not before launching a campaign.
• C (Contract requirements for independent oversight) is a governance mechanism, not a prerequisite for designing an awareness campaign; it addresses accountability, not campaign strategy.
• D (Business objectives of senior leaders) is tempting but narrower than strategic goals - individual leaders' objectives may shift or conflict, whereas organizational strategic goals represent the authoritative, enterprise-wide direction that a privacy office should anchor to.

Memory tip: Think "Strategy before Story." A campaign is a story you tell your organization - but you can't tell a coherent story without first knowing the plot (strategic goals). Everything else (documentation, oversight, individual objectives) flows from or supports the strategy, not the other way around.

No community discussion yet for this question.