Question

After completing a DPIA for a new customer analytics platform, the privacy team identifies a high risk that granular location data could enable re-identification of individuals. The team applies aggregation and access controls, reducing the risk to a level that still exceeds the organization's documented risk appetite. Development leadership wants to launch on schedule. What is the MOST appropriate next step for the privacy engineer?

Accepted Answer

Escalate the residual risk to accountable senior management for a formal risk acceptance decision before launch

Answer

Approve the launch since technical safeguards were already applied to reduce the risk

Answer

Document the residual risk in the risk register and proceed, treating it as an operational matter

Answer

Require that the platform be redesigned to eliminate all location data processing prior to launch