Question

A multinational retailer processes customer personal data in several countries. Its internal data protection policy was written to satisfy the requirements of the country where the corporate headquarters is located. During an audit, the IS auditor finds that one subsidiary operates in a jurisdiction whose privacy law imposes stricter consent and data-transfer requirements than the corporate policy. Which of the following should the auditor recommend as the MOST appropriate course of action?

Accepted Answer

Ensure the subsidiary complies with the stricter local privacy law where it applies, and align the corporate policy to accommodate jurisdictional differences

Answer

Apply the corporate policy uniformly across all subsidiaries to ensure consistency of controls

Answer

Allow the subsidiary to define its own independent policy with no oversight from headquarters

Answer

Defer the matter until the local regulator issues an enforcement action against the subsidiary