Question

Difficulty: MediumData Governance, Classification, and Privacy Controls

A multinational online retail corporation is designing a automated data privacy lifecycle and governance framework for its customer analytics platform across international jurisdictions. Which of the following governance controls and privacy principles should the security architecture team implement to meet data protection obligations? (Select TWO).

  1. Data sovereignty policies ensuring customer records are stored and processed within legal geographic boundaries defined by local privacy regulations.Answer
  2. Data minimization procedures that restrict the collection and retention of personal telemetry to only what is strictly necessary for operational metrics.Answer
  3. C
    Delegating data sensitivity classification authority exclusively to database administrators maintaining the infrastructure assets.
  4. D
    Configuring public key infrastructure certificates as the primary mechanism to enforce role-based access authorization boundaries across data lakes.

Answer

The security team should implement data sovereignty policies to maintain jurisdictional compliance and data minimization procedures to restrict collected personal data to only necessary operational requirements.
Data sovereignty ensures data complies with geographic legal requirements regarding storage and processing boundaries. Data minimization ensures organizations limit data collection and retention to only what is required for defined processing purposes, directly reducing regulatory and privacy risk exposure.

Step-by-Step Solution

1
Analyze privacy governance principles applicable to multinational data processing.
Identified data sovereignty as a legal requirement restricting cross-border data flows and data minimization as a core privacy principle.
Multinational entities must adhere to regional data residency laws and reduce privacy risk exposure by collecting minimal PII.
2
Evaluate operational role assignments and authentication mechanisms in wrong choices.
Distinguished data owner responsibilities from technical custodians and separated identity verification mechanisms from authorization boundaries.
Classification authority belongs to data owners, and authorization relies on access control models rather than identity certificates.

Key Concept

Data Governance and Privacy Principles
Rate this question