Which of the following should an IT privacy practitioner do FIRST when assessing the potential impact of new privacy legislation on the organization?

Question

Options

• AIdentify systems and processes that contain privacy components.
• BResearch and identify privacy legislation in other countries that may contain similar requirements.
• CShare operational plans for achieving compliance with regulatory entities.
• DRestrict the collection of personal information until there is assurance the organization is

• A
  82% (27)
• B
  9% (3)
• C
  6% (2)
• D
  3% (1)

Explanation

Before any compliance strategy can be developed, the practitioner must first identify what systems and processes contain privacy components - this is a gap analysis prerequisite. You cannot assess legislative impact without knowing where personal data lives and how it is processed. Researching similar legislation (B) is a secondary research step. Sharing operational compliance plans (C) is premature before assessment is complete. Restricting data collection (D) is a drastic operational action that should not be taken before understanding the actual requirements. Identifying systems and data flows first establishes the scope of the compliance effort.

No community discussion yet for this question.