Which party should data subject contact FIRST if they believe their personal information has been collected and used without consent?

The data subject should contact the organization’s chief privacy officer (CPO) first if they believe their

personal information has been collected and used without consent. The CPO is the senior executive

who is responsible for establishing and maintaining the organization’s privacy vision, strategy, and

program. The CPO oversees the development and implementation of privacy policies, procedures,

standards, and controls, and ensures that they align with the organization’s business objectives and

legal obligations. The CPO also leads the privacy governance structure, such as the privacy steering

committee, and coordinates with other stakeholders, such as the data protection authorities, the

privacy rights advocates, and the outside privacy counsel, to ensure that privacy is integrated into all

aspects of the organization’s operations. The CPO is the primary point of contact for data subjects

who have any questions, complaints, or requests regarding their personal information, and who can

address their concerns and resolve their issues in a timely and effective manner. Reference: : CDPSE

Review Manual (Digital Version), page 21