Data protection regulations generally require what regarding sensitive data?

• A. Breach notification is the only requirement
• B. Organizations should implement safeguards for sensitive data
• C. Encryption is mandatory in all jurisdictions
• D. There are no standard requirements

Answer: (B)

Data protection regulations emphasize putting safeguards in place to protect sensitive data, not just reacting after a problem occurs. They require a proactive approach with technical and organizational controls to maintain confidentiality, integrity, and availability. This means using measures like strong access controls, encryption where appropriate, secure data handling and storage, proper data retention and disposal, and ongoing monitoring and risk assessments. Breach notification is common across many laws, but it represents only one aspect of compliance, not the whole picture. Encryption is important and often required in certain contexts or jurisdictions, but it isn’t universally mandatory for every situation. So the emphasis is on implementing safeguards for sensitive data through a layered, defense-in-depth strategy.