Privacy leads propose a register of higher-risk data processing activities for resident casework systems. What practice does this support?
Select an answer to reveal the explanation.
Short Explanation
A register of the risky ways you use people’s data is like a labeled hazard board in a workshop—everyone can see what needs extra care. Higher-risk processes deserve that visibility.
Full Explanation
A register of higher-risk data processing activities for resident casework systems supports the protection practice of maintaining inventories of higher-risk processing—so privacy, security, and governance can prioritize controls where civic harm potential is greatest. Eliminating all processing inventories because they slow projects fails by removing visibility needed for proportionate protection. Recording only marketing campaigns and ignoring casework systems fails because casework often processes sensitive resident data at higher stakes than outreach lists. Replacing security controls with the register alone fails; an inventory informs controls—it does not substitute for access, encryption, or monitoring. Exam caveat: processing inventories are a privacy governance tool, not a complete control stack. Operational check: stand up or refresh the higher-risk register for casework systems, assign owners, link each entry to controls and DPIA/assessment status where required, and review it on a fixed cadence with privacy and the data council. Use the register to prioritize civic remediation funding toward the highest-risk resident processing first. Keep verification evidence with the municipal runbook so audits can prove the chosen control was applied as designed and that rejected alternatives would have left city services exposed to the failure modes described above.