Question

A retail company wants to share a customer transaction dataset with an external marketing analytics partner to build predictive models. The dataset includes names, email addresses, purchase history, and loyalty IDs. Legal has confirmed a valid legal basis exists, and a data processing agreement is in place. As the privacy engineer, what is the MOST important control to implement before transmitting the dataset to the partner?

Accepted Answer

Apply pseudonymization or field-level de-identification to remove direct identifiers not required for the modeling purpose, then transmit only the necessary attributes over an encrypted channel

Answer

Encrypt the full dataset at rest and in transit while transmitting all fields, since the DPA legally binds the partner to protect the data

Answer

Require the partner to sign an additional non-disclosure agreement before any data is shared

Answer

Transmit the complete dataset and rely on the partner's contractual obligation to delete unused fields after modeling is complete