CIPM: Certified Information Privacy ManagerDemo

By IAPP · Question Mode

QuestionQ73

Privacy Operational Lifecycle: Assess

Based on the scenario, what is the most appropriate next action Jonathan should take?

  • A Consult with the legal team to determine how to address the data subjects' requests and determine the risk of noncompliance.
  • B Consult with other key stakeholders to create a presentation on the incident and lessons learned for the board of directors.
  • C Consult with the public relations team to discuss potential brand impact of not responding to the data subjects' requests.
  • D Consult with the information technology team to understand how and why this cloud account was not disabled.
Explanation

Data controllers must respond to subject access requests without undue delay and ordinarily within one month. When the potentially responsive personal data has been destroyed and the organization lacks a subject access request policy, legal counsel should determine the organization’s response obligations, available limitations or exemptions, and the legal risk of noncompliance before other incident-management activities proceed.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!