Question

A multinational retailer is drafting its enterprise privacy policy to support operations across several jurisdictions with differing privacy laws (GDPR, CCPA, and others). The privacy officer wants the policy to be durable and not require rewriting each time a minor regulatory change occurs. Which approach should the privacy officer take when developing the corporate privacy policy?

Accepted Answer

Base the policy on internationally recognized privacy principles and a common framework, then address jurisdiction-specific requirements through supporting standards and procedures

Answer

Draft a separate, self-contained privacy policy for each jurisdiction so that every legal nuance is captured directly in the policy text

Answer

Adopt the strictest single law verbatim as the enterprise policy and apply it uniformly to all jurisdictions and data

Answer

Defer policy creation until all applicable laws are harmonized so the policy reflects one consistent legal standard