Question

A privacy solutions engineer is establishing the organization's first enterprise data inventory to support Data Life Cycle Management. During initial interviews, several business units confirm they store customer personal data in departmentally-provisioned SaaS tools and local spreadsheets that were never registered with IT. Which action should the engineer take FIRST to ensure the data inventory accurately reflects where personal data resides?

Accepted Answer

Perform automated data discovery and network scanning to detect unregistered repositories and reconcile results against the self-reported inventory

Answer

Require each business unit to sign an attestation that all personal data has been disclosed before finalizing the inventory

Answer

Block all unsanctioned SaaS applications at the network firewall to force data back into approved systems

Answer

Apply the organization's data classification scheme to the repositories that have already been reported