Question

A retail company completed a DPIA for a new customer loyalty analytics platform before launch, identifying and treating several privacy risks. The platform has now been operational for eight months. During this period, the analytics vendor introduced a new machine-learning feature that profiles customers to predict purchasing behavior, and the volume of processed data has tripled. The privacy officer wants to ensure the DPIA remains a living document. What is the MOST appropriate action?

Accepted Answer

Review and update the DPIA to reassess risks arising from the new profiling feature and the increased data volume

Answer

Treat the original DPIA as final since it was approved prior to launch and the identified risks were already mitigated

Answer

Wait until the annual privacy audit cycle to evaluate whether the platform changes introduced new privacy risks

Answer

Issue a new customer privacy notice describing the profiling feature and consider the DPIA obligation satisfied