A global organization has implemented an application that does not address all privacy requirements across multiple jurisdictions. Which of the following risk responses has the organization adopted…

Risk avoidance involves eliminating the risk by stopping the activity that causes it, which is not happening here as the application is implemented.

Risk transfer shifts the financial impact of a risk to a third party, typically through insurance or contracts, which is not described.

Risk mitigation involves implementing controls or actions to reduce the likelihood or impact of a risk, which the organization has failed to do regarding privacy requirements.

Risk acceptance occurs when an organization acknowledges a risk but decides not to take action to reduce or eliminate it, often because the cost of mitigation outweighs the potential impact or the risk falls within an acceptable tolerance. By deploying an application that doesn't meet all privacy requirements, the organization has implicitly or explicitly accepted the associated compliance and privacy risks.