Question

During a DPIA for a new customer analytics platform, the privacy engineer identifies a high risk that free-text comment fields may capture sensitive personal data (e.g., health details) that users enter unexpectedly. The business insists the comment fields are essential to the product. Which risk treatment approach BEST reduces this privacy risk while preserving the business function?

Accepted Answer

Deploy automated content-scanning to detect and redact sensitive data patterns entered into the comment fields

Answer

Accept the residual risk since the comment fields are a documented business requirement

Answer

Purchase cyber-liability insurance to cover potential regulatory fines from mishandled sensitive data

Answer

Add a privacy notice disclaimer stating users should not enter sensitive information