Which statement best describes how data should be processed to protect personal information?

• A. Processing security is optional if the data is encrypted.
• B. Data processing is always secure regardless of controls.
• C. Processing should implement security measures to protect personal data from unauthorized access.
• D. Processing security applies only to marketing data.

Answer: (C)

The main idea is that any handling of personal information should be protected with security measures to prevent unauthorized access. Data isn’t just at risk when it’s being encrypted or when it’s marketing data; it can be exposed at rest, in transit, during processing, or in backups. Encryption is important, but it doesn’t by itself cover all risks—things like who can access the data, how keys are managed, how systems are configured and monitored, and how incidents are detected and responded to all matter. So implementing a range of security controls—access controls, strong authentication, proper key management, logging and monitoring, and an incident response plan—is essential to keep personal data safe. The other statements give the impression that security is optional, automatic, or limited to certain data, which isn’t how responsible data processing works.