A regulator asks who in the organization is ultimately accountable for ensuring that customer personal data is handled in line with legal requirements. Which answer is correct?
Select an answer to reveal the explanation.
Short Explanation
Accountability lives where the authority and the money live, and that's senior management, with data owners carrying it for their own data. You as the security manager advise, coordinate and report, but you don't own the business's legal duties. The trap is the job title with 'security' in it.
Full Explanation
Accountability for regulatory compliance rests with those who have authority over the business and its resources. Senior management, overseen by the board, is ultimately accountable for ensuring the organization meets its legal obligations, and data owners, typically business managers, are accountable for the data within their areas, including its classification and the protection requirements that follow. The security manager plays an essential role by identifying requirements, designing and recommending controls, monitoring effectiveness and reporting, but this is an advisory and coordinating role; making the security manager accountable would place legal responsibility on someone who does not control the business decisions that create the risk. IT operations teams act as custodians, implementing and operating controls on behalf of owners, so they are responsible for execution, not accountable for compliance. A compliance analyst gathers evidence and supports reporting, but evidence preparation is an operational task with no ownership of the obligation itself. Exam caveat: some laws require a named officer, such as a data protection officer, with specific duties; even then, the organization's management remains accountable for compliance. Operational check: confirm that the RACI for each regulated data set names a senior business owner as accountable.