nerdexam
Isaca

CRISC · Question #82

An organization wants to launch a campaign to advertise a new product Using data analytics, the campaign can be targeted to reach potential customers. Which of the following should be of GREATEST…

The correct answer is D. Purpose limitation. When an organization uses data analytics to target an advertising campaign for a new product, the greatest concern for a risk practitioner is ensuring the data is used only for its original intended purpose.

Submitted by fatima_kr· Apr 18, 2026Governance

Question

An organization wants to launch a campaign to advertise a new product Using data analytics, the campaign can be targeted to reach potential customers. Which of the following should be of GREATEST concern to the risk practitioner?

Options

  • AData minimization
  • BAccountability
  • CAccuracy
  • DPurpose limitation

How the community answered

(32 responses)
  • A
    6% (2)
  • B
    9% (3)
  • C
    25% (8)
  • D
    59% (19)

Why each option

When an organization uses data analytics to target an advertising campaign for a new product, the greatest concern for a risk practitioner is ensuring the data is used only for its original intended purpose.

AData minimization

Data minimization, while important, addresses the volume of data collected, whereas the question focuses on the *use* of existing data for a new purpose.

BAccountability

Accountability is a broader principle of responsibility for data handling, but purpose limitation is the specific principle most directly challenged by this scenario.

CAccuracy

Accuracy ensures data is correct and up-to-date, but the primary concern here is the legitimate scope of data usage, not its factual correctness.

DPurpose limitationCorrect

Purpose limitation dictates that personal data collected for a specific, explicit, and legitimate purpose should not be processed subsequently in a manner incompatible with that original purpose. Using existing customer data for a new advertising campaign requires careful consideration to ensure it aligns with the initial purpose for which the data was collected, or that appropriate consent has been obtained, to avoid privacy violations.

Concept tested: Data privacy principles, purpose limitation

Source: https://learn.microsoft.com/en-us/compliance/regulatory/gdpr-data-minimization

Topics

#Data Privacy Principles#Purpose Limitation#Targeted Marketing Risk#Data Governance

Community Discussion

No community discussion yet for this question.

Full CRISC Practice