Data protection enforcement programs may include which of the following?

• A. They are purely voluntary
• B. They involve only recommendations
• C. They may include fines and audits
• D. They apply only to government agencies

Answer: (C)

Enforcement programs rely on consequences to ensure organizations protect personal data. They may include fines and audits because penalties and independent reviews motivate compliance, allow regulators to verify adherence, and drive remediation when violations occur. Relying solely on voluntary actions or recommendations would not deter noncompliance, and enforcement powers can apply beyond government agencies to private organizations depending on the law. Therefore, fines and audits are a central part of data protection enforcement.