Question

A retail company is migrating customer records from an aging on-premises CRM to a new cloud-based data warehouse that will support both operations and analytics. The legacy CRM has accumulated 15 years of records, including many inactive accounts, duplicate entries, and free-text notes fields containing sensitive personal data collected under purposes that no longer apply. The project manager wants to lift-and-shift all records as-is to meet the migration deadline, then clean up later. As the privacy solutions engineer, what should you recommend FIRST?

Accepted Answer

Apply data minimization and quality controls before migration by filtering out records that exceed retention limits or lack a current lawful purpose, and remediating duplicate and unnecessary data

Answer

Proceed with the full lift-and-shift to meet the deadline, since data quality and minimization can be addressed after the warehouse is operational

Answer

Encrypt all records in transit and at rest during migration, which satisfies the privacy obligations for the legacy dataset

Answer

Migrate all records but restrict analytics access to the warehouse to authorized personnel only