Which of the following is MOST important for an IS auditor to examine when reviewing an organization's privacy policy?

The most critical element for an IS auditor to verify when reviewing a privacy policy is the organization's legitimate purpose for collecting personal data. This aligns with the fundamental privacy principle of "purpose limitation," which is a cornerstone of virtually all major privacy regulations and frameworks (e.g., GDPR, OECD Guidelines). This principle dictates that data should only be collected for specified, explicit, and legitimate purposes. Verifying this purpose is the primary step, as without a valid reason for collection, all subsequent processing, sharing, and protection activities lack a proper legal and ethical foundation. The purpose defines the scope for data usage, retention, and security requirements.

A. Regulators establish legal frameworks for data collection; they do not typically grant explicit, case-by-case permission. Organizations are responsible for ensuring their collection practices comply with these frameworks.

C. Prohibiting all third-party sharing is often impractical for business operations. The policy should instead define the conditions, controls, and legal basis under which sharing is permissible.

D. The specific encryption mechanism is a technical implementation detail for protecting data. While important, the policy's primary role is to establish the "why" (purpose), not the specific "how" (technical control).

1. ISACA

CISA Review Manual

27th Edition. Chapter 4

Section 4.4.1

"Privacy Principles." The manual outlines key privacy principles

including the "Purpose Specification Principle

" which states that the purpose for which personal data is collected should be specified to the data subject at or before the time of collection. This establishes the legitimate purpose as a foundational requirement.

2. Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation - GDPR). Article 5

"Principles relating to processing of personal data

" paragraph 1(b). This article explicitly states that personal data shall be "collected for specified

explicit and legitimate purposes..." This is a primary legal requirement that an auditor must verify.

3. NIST. (2020). NIST Privacy Framework: A Tool for Improving Privacy through Enterprise Risk Management

Version 1.0. Section 2.2

"Core

" Function "Govern-P (GV.P)." This governance function emphasizes establishing and communicating the organization's privacy values and objectives

which inherently includes defining the legitimate purposes for data processing as a basis for its privacy program.