Which control addresses privacy risk management across the life cycles of all processes that collect or handle PII?

• A. AR-2 Privacy Impact and Risk Assessment
• B. DI-1 Data Quality
• C. DM-1 Data Minimization
• D. TR Privacy Control

Answer: (A)

The main idea is to manage privacy risk across every stage of the processing lifecycle for any process that handles PII. AR-2 Privacy Impact and Risk Assessment requires examining privacy implications and risks for all processing activities, from design through development, deployment, operation, and eventual decommissioning. It calls for privacy impact assessments and ongoing risk assessments as systems and processes change, ensuring safeguards are built in and kept up to date throughout the entire lifecycle. This lifecycle-focused risk management is what makes AR-2 the best fit for addressing privacy risk across all processes that collect or handle PII.

Data quality focuses on how accurate and complete the data are, not on privacy risk management across lifecycles. Data minimization aims to limit the amount of data collected, which is about data scope rather than ongoing privacy risk management across processing life cycles. A generic privacy control may address privacy in a broad sense but typically does not mandate the structured, lifecycle-wide risk assessment and mitigation that AR-2 requires.