Question

A privacy engineer is asked to update the organization's data flow diagrams for a customer relationship management (CRM) platform before a new marketing analytics initiative launches. During the mapping exercise, the engineer discovers that a subprocessor replicates a copy of customer records to a data center in a third country that is not documented in the current record of processing activities or any transfer mechanism. What should the privacy engineer do FIRST?

Accepted Answer

Document the newly identified data flow and undocumented cross-border transfer in the data map, then escalate the finding so a lawful transfer mechanism and risk assessment can be evaluated

Answer

Immediately instruct the subprocessor to delete all replicated records in the third country to eliminate the exposure

Answer

Proceed with the marketing analytics launch since the transfer predates the new initiative and is outside its scope

Answer

Add an encryption control to the replicated data set so the transfer no longer requires a lawful basis