Question

A newly appointed privacy program manager at a mid-sized financial services firm discovers that different business units each maintain their own informal spreadsheets describing what personal data they collect and why, but there is no consolidated, organization-wide view. Regulators have recently requested evidence of how the firm tracks its processing activities. Which action should the privacy program manager prioritize FIRST to establish a defensible foundation for the privacy program?

Accepted Answer

Establish and maintain a centralized record of processing activities (data inventory) covering data categories, purposes, legal basis, and data flows

Answer

Deploy a data loss prevention (DLP) tool across all endpoints to automatically detect personal data in motion

Answer

Draft an updated external privacy notice describing the categories of data the firm processes

Answer

Require each business unit to complete a data protection impact assessment (DPIA) for every existing processing activity