An organization has outsourced its customer management database to an external service provider. Of the following, who should be accountable for ensuring customer data privacy?

The organization that collects and ultimately owns the customer data retains ultimate accountability for its privacy, regardless of whether processing is outsourced. The business process owner is directly responsible for the specific business function and its associated data, making them accountable for ensuring compliance with privacy requirements as they define and oversee the process.

While the information security manager is responsible for implementing security controls, accountability for overall data privacy, especially regarding business processes and compliance, typically rests higher within the business ownership structure.

The vendor management officer manages the relationship with the vendor but does not typically hold the ultimate accountability for the privacy of the data itself, which belongs to the business owner.

The vendor's risk manager is responsible for the vendor's risks, but the ultimate accountability for the client organization's data privacy remains with the client organization.