Question

A multinational retailer operating in the EU, US, and Asia has grown through acquisitions, resulting in fragmented and inconsistent privacy practices across regions. The newly appointed data privacy officer wants to establish a single, structured foundation that maps privacy activities to core privacy principles while remaining adaptable to multiple jurisdictions' laws. Which action should the privacy officer take FIRST to achieve this?

Accepted Answer

Adopt a recognized privacy framework (such as the NIST Privacy Framework or ISO/IEC 27701) as the organizing structure for the privacy program

Answer

Draft region-specific privacy policies for each jurisdiction and deploy them independently

Answer

Purchase a consent management platform to standardize data subject interactions globally

Answer

Conduct privacy awareness training for all employees across every acquired entity