Which of the following presents the GREATEST privacy risk related to personal data processing for a global organization?

Lack of privacy risk awareness training is a significant internal control weakness, but it is typically less severe than the inherent risks of cross-border data transfers to potentially less stringent jurisdictions.

Not incorporating privacy into the risk management framework is a systemic flaw, yet the direct operational risk of cross-jurisdictional data processing often carries higher, more immediate compliance penalties.

Allowing staff with access to personal data to work remotely introduces risks, but these can often be mitigated through technical controls and policy, unlike the fundamental jurisdictional challenges of offshore processing.

Offshore data processing introduces significant complexity in complying with varying international data protection laws, potential conflicts of law, challenges in exercising data subject rights, and difficulties in regulatory oversight across different jurisdictions, elevating the overall privacy risk.