Certified Data Privacy Solutions Engineer (CDPSE) — Question 181

An organization wants to change the originally specified purpose of collected personal data. What must be done NEXT?

Answer options

• A. Notify data protection authorities.
• B. Obtain consent from data subjects.
• C. Update the enterprise data architecture.
• D. Revise the privacy notice.

Correct answer: D

Explanation

The correct action is to revise the privacy notice to inform data subjects of the new purpose for the data collection. Notifying data protection authorities and obtaining consent may be necessary depending on the jurisdiction, but the immediate next step is to ensure that the privacy notice reflects the change. Updating the enterprise data architecture is irrelevant to the requirement of informing data subjects about the purpose change.