Privacy governance is about setting direction and defining roles and responsibilities across the organization for managing personal data. It:

B: Defines strategy and takes decisions on privacy-related matters

C: Enables execution of policies to handle operational privacy incidents

D: Ensures that privacy accountability is not overlooked

Option A is incorrect because governance is not limited to computer resources—it spans all organizational functions involving personal data processing .

The modern definition of consent, as defined under the DSCI Privacy Framework and GDPR, includes the following criteria:

It must be freely given, specific, informed, and unambiguous

It must be indicated by a clear affirmative action

Individuals must be able to withdraw consent at any time

It must not be bundled or forced (e.g., acceptance of multiple processing purposes without choice)

Bundled consent—where the individual must consent to multiple unrelated data processing purposes together—is not aligned with the requirement of specific and informed consent. Hence, Option C is incorrect.

According to the DSCI Assessment Framework for Privacy (DAF-P©), the techniques for reducing identifiability differ in their effectiveness:

Pseudonymization replaces identifiable fields within a data record with artificial identifiers. However, if additional information (mapping or lookup tables) exists, re-identification is possible.

De-identification removes or masks identifiers, but residual or quasi-identifiers may still allow re-identification under certain conditions.

Anonymization aims to irreversibly remove any link between the data and the identity of the subject, thus presenting the least risk of re-identification.

Therefore, when arranged in decreasing order of re-identification risk:

Pseudonymization (highest risk)

De-identification

Anonymization (lowest risk)

This validates option A. I, II as correct.

According to the DSCI Privacy Framework and aligned with global privacy principles such as those found in the OECD and APEC frameworks, “Collection Limitation” emphasizes that personal data should be collected in a manner that is lawful and fair, and should be limited to what is necessary for the identified purposes.

As per DSCI Assessment Framework for Privacy (DAF-P©), this principle ensures organizations collect only relevant data by minimizing unnecessary data acquisition, thereby reducing the privacy risks. The principle mandates:

" Personal data collected should be adequate, relevant, and limited to what is necessary in relation to the purposes for which they are processed. "

This is designed to promote responsible data stewardship and ensure minimal exposure of individuals’ personal information.

The DPF’s “Regulatory Compliance Intelligence (RCI)” practice area is focused on identifying and mapping applicable legal and compliance requirements to the specific data elements across business processes. This enables organizations to operationalize compliance obligations by linking them directly with the data they manage.

RCI helps ensure that every data flow or processing activity has a mapped legal basis and complies with jurisdictional requirements.