Certified Information Privacy Technologist (CIPT) — Question 120

An organization has completed the acquisition of a smaller rival in a different but related industry. The acquisition was approved by the regulator on the condition that the personal data sets may not be combined. A way of achieving this objective is through?

Answer options

• A. Encryption.
• B. Disassociation.
• C. k-anonymity.
• D. Pseudonymization.

Correct answer: B

Explanation

Disassociation is the process of separating personal data from identifiable information, making it impossible to link the data back to individuals. This directly addresses the regulatory requirement to keep the personal data sets distinct. The other options, such as Encryption and Pseudonymization, still allow for potential re-identification, while k-anonymity focuses on data masking but does not ensure complete separation of data sets.