Counsel asks which reports and datasets fall under a new state privacy act. What prerequisite must governance complete first?
Select an answer to reveal the explanation.
Short Explanation
You cannot protect what you have not found. Before answering the privacy-act question, inventory and classify—know what personal data you hold and which systems keep it.
Full Explanation
When counsel asks which reports and datasets fall under a new state privacy act, governance must first use inventory and classification to know what personal data is held and where. Without that map, civic legal advice and control design are guessing. Rewriting the public website privacy banner and calling mapping done fails because a banner does not inventory systems, fields, or sharing paths. Assuming no personal data exists because systems are on-premises fails; residency of servers does not erase personal data content. Waiting for an external lawsuit before locating personal data stores fails as a reactive posture incompatible with proactive public-sector privacy duty. Exam caveat: inventory and classification are prerequisites to applying privacy law to specific assets—do not skip to communications cosmetics. Operational check: produce or update a personal-data inventory tied to systems and classifications, have counsel review coverage for the new act, and prioritize gaps for high-risk resident casework data. Keep the inventory living under stewardship so the next statutory change does not restart from zero. Keep verification evidence with the municipal runbook so audits can prove the chosen control was applied as designed and that rejected alternatives would have left city services exposed to the failure modes described above.