How should the agency manage data privacy and security?

• A. Keep all data in public folders for easy access.
• B. Ensure secure storage, access controls, employee training, and compliance with privacy laws.
• C. Share confidential information freely with outside partners.
• D. Ignore privacy laws if permissions are granted verbally.

Answer: (B)

Data privacy and security rely on controlling who can access information, how it’s kept safe, and staying within the law. The best approach combines secure storage, strong access controls, ongoing employee training, and strict adherence to privacy laws. Secure storage protects data from loss or theft, often through encryption and secure servers or locked records. Access controls ensure only authorized staff can view or modify information, using least-privilege principles and role-based permissions. Employee training builds a culture of careful data handling, teaching everyone how to recognize risks and follow proper procedures. Compliance with privacy laws ensures the agency follows required standards, maintains proper documentation, and has processes for audits and incident response.

The other options miss essential safeguards: putting data in public folders makes it easily accessible to many people, creating a clear vulnerability. Freely sharing confidential information with outside partners disregards confidentiality and could violate agreements and laws. Ignoring privacy laws, even with verbal permissions, is unsafe and typically unlawful, since many protections require written policies and formal processes.