Which statement best describes AR-6 Privacy Reporting?

• A. The org develops, disseminates, and updates reports to OMB, Congress, and other oversight bodies, as appropriate to demonstrate accountability with specific statutory and regulatory privacy programs
• B. The org minimizes PII collection to approved purposes
• C. The org inventories PII across systems
• D. The org leads the privacy incident response plan

Answer: (A)

AR-6 Privacy Reporting centers on accountability through formal reporting to oversight authorities. The organization develops, disseminates, and updates reports to OMB, Congress, and other oversight bodies, as appropriate to demonstrate accountability with specific statutory and regulatory privacy programs. This kind of reporting keeps leadership and policymakers informed about how privacy programs are functioning, their compliance status, and risk management, which supports evaluations, budget decisions, and policy adjustments. The other activities—minimizing PII collection, inventorying PII across systems, or leading the privacy incident response plan—are essential privacy practices, but they describe internal processes rather than the external accountability reporting that AR-6 requires.