An organization wants to change the originally specified purpose of collected personal data. What must be done NEXT?

Question

Options

• ANotify data protection authorities.
• BObtain consent from data subjects.
• CUpdate the enterprise data architecture.
• DRevise the privacy notice.

• A
  6% (2)
• B
  9% (3)
• C
  3% (1)
• D
  81% (26)

Explanation

A privacy notice is the primary mechanism by which an organization communicates to data subjects how their personal data is used. When the purpose of processing changes, the privacy notice must be updated first to accurately reflect the new purpose before any downstream actions (such as notifying authorities or obtaining new consent). The privacy notice is the foundational transparency document-updating it is the immediate next step. Subsequent actions like obtaining consent or notifying regulators may follow depending on the new purpose and applicable legal basis, but the notice revision comes first.

No community discussion yet for this question.