Which of the following BEST enables an IT privacy practitioner to ensure appropriate protection for personal data collected that is required to provide necessary services?

Question

Options

• AUnderstanding the data flows within the organization
• BImplementing strong access controls on a need-to-know basis
• CAnonymizing privacy data during collection and recording
• DEncrypting the data throughout its life cycle

• A
  95% (42)
• B
  2% (1)
• D
  2% (1)

Explanation

Understanding data flows (A) is the foundational step that enables all other protections - you cannot protect what you don't know exists. By mapping where personal data originates, how it moves, who handles it, and where it's stored, a privacy practitioner can identify risks and apply appropriate controls proportionally across the entire data lifecycle.

Why the distractors fall short:

• B (access controls) is a valid control, but it's reactive and narrow - it protects data in place but doesn't help you discover unprotected data flows you didn't know about.
• C (anonymizing at collection) is too aggressive; anonymized data can no longer be used to provide the necessary services mentioned in the question, defeating the purpose.
• D (encryption throughout lifecycle) is a strong technical safeguard, but encrypting data you haven't fully mapped still leaves gaps - you may miss data stores or flows entirely.

Memory tip: Think of data flow understanding as the map before the journey - access controls, encryption, and anonymization are tools you pack, but without the map, you won't know which roads need them.

No community discussion yet for this question.