Your company has to ensure that it meets the requirements set down in personal data protection legislation. What is the first thing you should do?

Question

Options

• AMake the employees responsible for submitting their personal data.
• BTranslate the personal data protection legislation into a privacy policy that is geared to the company and the
• CAppoint a person responsible for supporting managers in adhering to the policy.
• DIssue a ban on the provision of personal information.

• A
  2% (1)
• B
  74% (37)
• C
  16% (8)
• D
  8% (4)

Explanation

Translating legislation into a company-specific privacy policy (B) is the correct first step because you must interpret and operationalize abstract legal requirements into concrete, actionable rules that fit your organization's context before any other steps can follow. Without a policy, there is nothing to assign responsibility for (C), no framework to train employees on (A), and no basis for making informed decisions about data sharing (D). Option A is wrong because employees submitting personal data is a downstream activity, not a compliance starting point. Option C is premature - you need a policy before you can appoint someone to enforce it. Option D is an overreaction and operationally impractical; the goal is compliant data handling, not a blanket ban.

Memory tip: Think "Policy before People before Process" - you must define the rules (B) before assigning roles (C) or setting procedures (A/D).

No community discussion yet for this question.