問題文
A company wants to decide which changes require a privacy impact assessment. Which set of triggers is most useful for that purpose?
選択肢
- Every change that increases the number of records stored, because volume drives the severity of a potential breach and therefore sets the level of review.
- Each change requested by the marketing function, because those changes historically carried the most privacy risk, so routing that department's requests to review catches what matters.
- Any change that touches a system listed in the inventory as holding personal data, since that is the simplest rule to apply consistently and it guarantees that no processing change escapes review.
- A new category of personal data, a new purpose, a new recipient, a new jurisdiction, or processing that produces inferences about individuals.