Question

During a privacy control assessment, a CDPSE reviews the organization's data subject access request (DSAR) handling process. The documented procedure requires identity verification, a 30-day response window, and manager sign-off before disclosure. The procedure is well-designed and approved, but the assessor finds that over the past six months, 40% of DSARs were fulfilled without any recorded identity verification step. What is the MOST accurate conclusion the assessor should report?

Accepted Answer

The control is well-designed but operating ineffectively, creating a risk of unauthorized disclosure of personal data

Answer

The control is poorly designed and must be redesigned before it can be relied upon

Answer

The control is effective because a documented and approved procedure exists

Answer

The 40% exception rate is acceptable because the 30-day response window was consistently met