Which practice best supports client privacy within an organization?

• A. Limiting access to personal information to authorized personnel.
• B. Allowing broad access to all staff.
• C. Storing unprotected data on public servers.
• D. Requiring clients to opt out of all privacy protections.

Answer: (A)

Access control is the foundation of client privacy. Limiting access to personal information to authorized personnel embodies the principle of least privilege: people should only access data necessary to perform their duties. This minimizes the chance of accidental or intentional disclosures, improves accountability through access logs, and helps meet privacy requirements that mandate data minimization and controlled handling. In contrast, broad access broadens exposure, storing unprotected data on public servers creates obvious vulnerability, and requiring clients to opt out of protections shifts the burden away from safeguarding data, all of which undermine privacy.