Which requirement is specified by DI-1 Data Quality privacy control?

• A. Org take reasonable steps to confirm the accuracy and relevance of PII
• B. Org take appropriate steps to ensure the collection of PII is consistent with a purpose authorized by law or regulation
• C. The privacy incident response plan is led by SAOP/CPO
• D. NARA provides retention schedules for disposition of federal records

Answer: (A)

Data quality is about making sure PII is accurate, relevant, and usable for its intended purpose. DI-1 requires the organization to take reasonable steps to verify that the PII it maintains is accurate and relevant to why it’s collected and used. This helps ensure that decisions based on the data are sound and that privacy risks from incorrect or outdated information are minimized. The option that describes taking reasonable steps to confirm accuracy and relevance directly aligns with this control, embodying the ongoing checks and validation that data quality entails.

Other choices touch on different privacy controls: one about ensuring collection aligns with a legal or authorized purpose (purpose specification), another about who leads the privacy incident response, and another about retention schedules for records. These are important, but they address separate aspects of privacy governance, not the data quality requirement described by DI-1.