Which key stakeholder within an organization should be responsible for approving the outcomes of a privacy impact assessment (PIA)?

Which key stakeholder within an organization should be responsible for approving the outcomes of a privacy impact assessment (PIA)?
A . Data custodian
B . Privacy data analyst
C . Data processor
D . Data owner

View Answer

Answer: D

Explanation:

Reference: https://ico.org.uk/media/1042196/trilateral-full-report.pdf

The data owner is the key stakeholder within an organization who should be responsible for approving the outcomes of a privacy impact assessment (PIA). A PIA is a systematic process of identifying and evaluating the potential privacy risks and impacts of a data processing activity or system. The data owner is the person who has the authority and accountability for the data processing activity or system, and who determines the purpose and means of the data processing. The data owner should approve the outcomes of a PIA, such as the risk assessment, the risk mitigation plan, and the residual risk level, to ensure that they are consistent with the business objectives and legal obligations of the data processing activity or system.

Reference: CDPSE Review Manual (Digital Version), page 99