Which of the following is the BEST approach when providing data subjects with access to their personal data?

Question

Options

• AUse an email address to automatically generate a unique ID.
• BCreate a profile page where users can view their information.
• CDisable user profile data modification so there is no possibility to introduce mistakes.
• DOnly allow users to edit data fields that are not derived from their personal information.

• A
  7% (3)
• B
  86% (38)
• C
  5% (2)
• D
  2% (1)

Explanation

Creating a profile page where users can view their information is the best approach because it directly fulfills the data subject's right of access (as required by regulations like GDPR) in a transparent, user-friendly, and scalable manner. It allows individuals to see what data the organization holds about them without requiring manual intervention. Option A (using email to auto-generate a unique ID) introduces privacy risk by potentially exposing or linking identifiers inappropriately. Option C (disabling modification) would violate the right to rectification, which is a companion right to access under most privacy laws. Option D (restricting edits to non-derived fields) is overly restrictive and undermines data subjects' ability to correct inaccuracies in their own information.

No community discussion yet for this question.