How should CSS Block 2 ensure compliance with privacy and data protection regulations when processing personal data?

• A. Share personal data across all departments to improve efficiency.
• B. Apply data minimization, limit retention, obtain consent where required, and implement security controls.
• C. Retain all personal data indefinitely to be safe.
• D. Ignore encryption and access controls.

Answer: (B)

Processing personal data in a privacy‑conscious way means applying essential data protection principles: collect only what’s necessary, keep data only as long as needed, secure it, and rely on a lawful basis such as consent when required. The recommended approach follows these principles: data minimization reduces exposure by limiting what is collected; limiting retention decreases the time data is vulnerable and reduces risk; obtaining consent where required gives individuals control and helps meet regulatory requirements; and implementing security controls—like encryption, strict access controls, and monitoring—protects data from unauthorized access and breaches. This combination directly supports compliance with privacy laws and protects individuals’ information.

Sharing data across all departments without a clear, legitimate purpose undermines purpose limitation and increases risk. Retaining data indefinitely contradicts minimization and retention principles. Ignoring encryption and access controls leaves data exposed and fails to meet expected security standards.