Question

A privacy engineer is establishing governance for a large retailer that processes customer, employee, and marketing data across many systems. Business units disagree on which data elements should be treated as personal data, causing inconsistent handling and unclear protection requirements. Which action should the privacy engineer prioritize FIRST to resolve this?

Accepted Answer

Establish an enterprise data classification scheme that defines categories of personal data and their handling requirements

Answer

Deploy a data loss prevention (DLP) tool to automatically block transmission of any sensitive fields

Answer

Require each business unit to encrypt all databases regardless of the data they contain

Answer

Instruct legal counsel to issue a memo restating the statutory definition of personal data