A security policy forbids USB use with personal data, but the organisation has no monitoring, enforcement, or exception process. What lesson should CIPP/E candidates take about organisational measures?
Select an answer to reveal the explanation.
Short Explanation
A 'no USB' poster without checks is theater. Organisational measures have to live in the real hallway—monitoring, exceptions done right, consequences when needed. Paper policy without practice is a fridge magnet, not a control.
Full Explanation
Organisational measures under Article 32 must operate in the real workplace. A written ban on USB use with personal data, unsupported by monitoring, enforcement, or a controlled exception process, is policy theatre. Effective organisational measures require implementation and oversight—training, technical restrictions where feasible, approved exceptions, and consequences for violations—not policy text alone. CIPP/E candidates should treat large gaps between policy and practice as both security and accountability failures.
Written bans do not automatically satisfy Article 32 if nobody follows them. USB rules concern how personal data leave controlled environments and are firmly in scope when they protect against unauthorised processing or loss. Managed exception processes support legitimate work needs; pretending that any gap proves compliance, or that exceptions are forbidden while work still needs temporary media, is incoherent governance.
Exam caveat: “we have a policy” is weaker evidence than “we enforce and can evidence the control.” Operational check: deploy technical USB controls where feasible, define approval workflows and time-bound exceptions, log use on sensitive teams, and audit compliance. Civic employers handling resident case files should ensure hallway practice matches the policy binder the public implicitly trusts when it hands data to the city.