Question

A privacy solutions engineer reviews DPIAs completed by five different business units over the past year. Each unit used its own approach to rate privacy risks, and the resulting risk ratings vary widely for processing activities that involve similar data and similar risk exposure. Senior management cannot compare or prioritize the risks across units. What should the engineer recommend FIRST to address this problem?

Accepted Answer

Establish a standardized privacy risk assessment methodology with defined likelihood and impact criteria to be applied across all business units

Answer

Require all future DPIAs to be reviewed and re-scored solely by the central privacy office before submission to management

Answer

Mandate that each business unit purchase the same GRC tool to record its DPIA results

Answer

Increase the frequency of DPIAs so that more data points are available for comparison