CISA: Certified Information Systems Auditor

By Isaca · Question Mode

QuestionQ128

Information System Auditing Process

An audit of an organization’s data-privacy procedures finds that the initial purpose for collecting customers’ personal data has changed. What is the BEST way for the auditor to address this situation?

Explanation

Personal data should be processed only for purposes covered by the customer’s original consent or another valid legal basis. Comparing the original consent with the current use establishes whether the changed purpose is authorized and whether corrective action, such as obtaining new consent, is required.

Community Discussion

No comments yet. Be the first to start the discussion!