Which of the following is the BEST indication that an organization needs to perform a privacy impact assessment (PIA)?

The correct answer is D. New personal information categories are being collected about customers.. Collecting new categories of personal information about customers is the classic trigger for a PIA. A PIA is specifically designed to evaluate the privacy risks introduced by new or changed data processing activities before they begin. Introducing a new data category represents a

Data Life Cycle

Question

Options

AThe privacy policy is included in an online training course.
BAn inventory of personal information is reported to stakeholders.
CThe privacy practices are being reviewed by clients.
DNew personal information categories are being collected about customers.

How the community answered

(56 responses)

A
7% (4)
B
2% (1)
C
14% (8)
D
77% (43)

Explanation

Collecting new categories of personal information about customers is the classic trigger for a PIA. A PIA is specifically designed to evaluate the privacy risks introduced by new or changed data processing activities before they begin. Introducing a new data category represents a material change to the organization's data practices, requiring assessment of risks, legal bases, and necessary controls. The other options - including training (A), inventory reporting (B), and client reviews (C) - reflect ongoing privacy governance activities, not triggering events that signal a new assessment is needed.

Topics

#Privacy Impact Assessment#PIA triggers#Data collection#Privacy risk management

Community Discussion

No community discussion yet for this question.

Full CDPSE Practice