Certified Data Privacy Solutions Engineer (CDPSE) — Question 32

As part of a major data discovery initiative to identify personal data across the organization, the project team has identified the proliferation of personal data held as unstructured data as a major risk. What should be done FIRST to address this situation?

Answer options

• A. Identify sensitive unstructured data at the point of creation.
• B. Classify sensitive unstructured data.
• C. Identify who has access to sensitive unstructured data.
• D. Assign an owner to sensitive unstructured data.

Correct answer: C

Explanation

Identifying who has access to sensitive unstructured data is crucial as it helps to understand the potential risks and vulnerabilities associated with that data. Without knowing who can access this data, it would be ineffective to classify it or assign ownership, as you wouldn't have a clear view of the exposure. Therefore, option C is the first logical step in managing the risk associated with unstructured personal data.