Question

A privacy engineer reviewing a data governance program finds that a customer analytics data set is stored in a cloud data warehouse managed by the IT infrastructure team, populated by the marketing department, and analyzed by the data science team. When a data subject requests deletion of their personal data, no group takes responsibility for authorizing and executing the deletion, and each team points to the others. Which action would BEST address the underlying governance gap?

Accepted Answer

Formally designate a data owner accountable for the data set's use, access decisions, and lifecycle actions

Answer

Assign the IT infrastructure team as the data custodian responsible for all deletion requests

Answer

Require the privacy office to execute all data subject deletion requests directly

Answer

Encrypt the data set so that deletion requests can be fulfilled by destroying the encryption keys