Skip to content

ACCA Strategic Professional · Strategic Business Leader · IT systems security and control

Brightpath Bank has a data protection officer reporting to the head of IT, who also decides how customer data is processed in new systems. A governance review criticises this arrangement. What is the most likely implication?

The DPO's independence is compromised, because the officer reports to the head of IT, who decides how data is processed and so is the person being monitored. Good governance requires the DPO to report to the board or senior management, free from conflicts of interest.

  1. AThe DPO's independence is compromised by a conflict of interest, so reporting should be to the boardCorrect
  2. BThe DPO must be replaced by an external auditor
  3. CCustomer data may then be processed without a lawful basis
  4. DThe bank must stop using new IT systems

Explanation

A DPO monitors compliance and must be independent and able to report to top management. Reporting to the person determining processing creates a conflict of interest. Replacing with an auditor or halting systems is unwarranted.

Did you get it right without looking?

One question tells you little. A timed set on IT systems security and control shows your real accuracy, how long you take and where you lose marks.

Practise IT systems security and controlFree diagnostic mock

More IT systems security and control questions