Question

During a privacy risk assessment, a data privacy engineer discovers that a legacy customer relationship database stores unencrypted personal data and lacks role-based access controls, allowing any authenticated employee to query full customer records. The database is scheduled for decommissioning in 18 months. What should the engineer do FIRST to address this finding?

Accepted Answer

Characterize the exposure as a vulnerability and evaluate its likelihood and impact within the privacy risk register before recommending treatment

Answer

Immediately implement full-disk encryption on the legacy database to eliminate the vulnerability

Answer

Accept the risk because the database will be decommissioned within 18 months

Answer

Escalate the issue directly to the supervisory authority as a potential breach of personal data