Question

A newly appointed privacy program manager at a mid-sized financial services firm is chartering the privacy program. The firm operates several business units, uses numerous SaaS tools, and has recently acquired a smaller company that has not yet been integrated. The manager must define the initial scope of the privacy program. What is the MOST important consideration when establishing the program's scope?

Accepted Answer

Identifying all personal data processing activities, systems, and legal entities across the organization that fall under applicable regulatory obligations

Answer

Limiting scope initially to the largest business unit to demonstrate quick wins to executives

Answer

Excluding the newly acquired company until its systems are fully integrated into the corporate infrastructure

Answer

Prioritizing the SaaS tools because cloud services present the highest inherent privacy risk