Question

A global retailer has an approved, board-endorsed privacy policy that commits the organization to honoring data subject access requests (DSARs) within regulatory timelines. Six months later, an internal audit finds that DSARs are handled inconsistently across regions, some are missed, and staff are unsure who is responsible for fulfilling them. The privacy policy itself is clear and current. What is the MOST likely root cause the privacy manager should address?

Accepted Answer

The organization lacks documented procedures and workflows that operationalize the policy into repeatable, assigned tasks

Answer

The privacy policy needs to be rewritten with more restrictive DSAR commitments

Answer

The board endorsement of the policy should be withdrawn until compliance improves

Answer

The organization should stop accepting DSARs until a new regulation is issued