Exam CDPSE Topic 4 Question 81 Discussion

Before using data from the organization's customer database for a new marketing application, the first step should be to determine what data is required by the application and for what purpose. This will help to ensure that the data collection and processing are relevant, necessary, and proportionate to the intended use, and that the data minimization principle is followed. Data minimization means that only the minimum amount of personal data needed to achieve a specific purpose should be collected and processed, and that any excess or irrelevant data should be deleted or anonymized1. This will also help to comply with the data privacy laws and regulations that apply to the organization, such as the General Data Protection Regulation (GDPR) or the California Consumer Privacy Act (CCPA), which require organizations to inform data subjects about the types and purposes of data processing, and to obtain their consent if needed23.
Reference:
ISACA, Data Privacy Audit/Assurance Program, Control Objective 2: Data Minimization, p. 61 ISACA, GDPR Data Protection Impact Assessments, p. 4-52 ISACA, CCPA vs. GDPR: Similarities and Differences, p. 1-23