Explanation
The primary objective of implementing privacy-related controls within an organization is to comply with legal and regulatory requirements that protect the rights and interests of individuals whose personal data are collected, processed, stored, shared or disposed by the organization. Privacy-related controls are based on principles such as lawfulness, fairness, transparency, purpose limitation, data minimization, accuracy, storage limitation, integrity, confidentiality and accountability. These principles aim to ensure that personal data are processed in a manner that respects the privacy of individuals and complies with the applicable laws and regulations in different jurisdictions. Preventing confidential data loss, identifying data at rest and data in transit for encryption, and providing options to individuals regarding use of their data are examples of specific privacy-related controls that support the primary objective of compliance. References: Privacy Regulatory Lookup Tool, CDPSE Official Review Manual, 2nd Edition

Section: Protection of Information Assets
Explanation:
The primary objective of a CSA program is to leverage the internal audit function by shifting some of the
control monitoring responsibilities to the functional area line managers. The success of a control self-
assessment (CSA) program depends on the degree to which line managers assume responsibility for
controls- Choices B, C and D are characteristics of a traditional audit approach, not a CSA approach.

Section: Protection of Information Assets