Question

A privacy solutions engineer maintains a risk register for a customer analytics platform that was last formally assessed 14 months ago. During a routine review, the engineer learns that the platform has recently begun ingesting geolocation data from a new mobile app, and the organization has expanded operations into two additional countries. Which action should the engineer take FIRST?

Accepted Answer

Trigger a reassessment of privacy risk for the platform because the processing scope and regulatory exposure have materially changed

Answer

Wait until the annual reassessment cycle to incorporate the changes into the existing risk register

Answer

Purchase additional cyber-liability insurance to cover the expanded geographic footprint

Answer

Notify the relevant supervisory authorities that new categories of data are being processed