A security policy forbids USB use with personal data, but the organ…

Question

A security policy forbids USB use with personal data, but the organisation has no monitoring, enforcement, or exception process. What lesson should CIPP/E candidates take about organisational measures?

Accepted Answer

Effective organisational measures require real implementation and oversight—not policy text alone. — A 'no USB' poster without checks is theater. Organisational measures have to live in the real hallway—monitoring, exceptions done right, consequences when needed. Paper policy without practice is a fridge magnet, not a control.

Answer

Written bans alone always satisfy Article 32 regardless of whether anyone follows them.

Answer

USB policies are outside GDPR because they concern hardware accessories, not personal data.

Answer

Exception processes are forbidden; any gap between policy and practice automatically proves compliance.

A security policy forbids USB use with personal data, but the organisation has no monitoring, enforcement, or exception process. What lesson should CIPP/E candidates take about organisational measures?

Short Explanation

Full Explanation