Privacy, Ethics, Governance and the Future of Analytics

Introduction

Digital marketing depends on data: search queries, website visits, purchases, advertising interactions, location signals, customer-service records and inferred interests. These data can improve relevance and measurement, but collection and analysis also create risks. People may be monitored without meaningful choice, excluded by automated decisions, exposed through security failures, or manipulated by interface design. Organisations may also make legally permissible decisions that are ethically unacceptable or commercially unsustainable.

Privacy, therefore, is not merely a compliance function. It is a condition of trustworthy measurement and durable customer relationships. Ethical analytics asks whether a practice respects human autonomy, avoids unjustified harm and distributes benefits fairly. Governance converts these principles into accountable decisions, documented controls and review processes.

This chapter examines consent, data protection, security, accessibility, dark patterns, algorithmic fairness and governance. It then assesses measurement after third-party cookies, privacy-enhancing technologies (PETs), data clean rooms and emerging developments in the analytics industry.

Learning objectives

By the end of this chapter, you should be able to:

• distinguish privacy, confidentiality, security, ethics and governance;
• explain lawful, fair and transparent data collection and consent;
• apply data minimisation, purpose limitation, retention and access-control principles;
• identify accessibility failures, dark patterns and algorithmic unfairness;
• design a practical analytics-governance process;
• compare cookieless measurement, PETs and clean rooms;
• evaluate contemporary analytics developments using professional and ethical criteria.

1. The foundations of responsible analytics

Privacy, protection and security

Privacy concerns a person’s ability to control information about themselves and to participate in society without unjustified observation or inference. Data protection concerns rules and practices governing the processing of personal data. Security concerns protection against unauthorised access, alteration, disclosure, loss or destruction. These concepts overlap but are not interchangeable. Encrypting a database improves security, but it does not make an excessive or unfair collection practice acceptable.

Confidentiality limits disclosure to authorised parties. Integrity protects accuracy and prevents unauthorised alteration. Availability ensures that legitimate users can access systems when required. Together, confidentiality, integrity and availability form the classic security triad.

Personal data generally includes information relating to an identified or identifiable person. Direct identifiers include names, email addresses and account numbers. Indirect identifiers may include a combination of device, location, time and behavioural attributes. Pseudonymisation replaces direct identifiers with codes but does not necessarily remove legal or practical identifiability. Anonymisation aims to make re-identification reasonably infeasible, although this is difficult when datasets can be linked.

Ethical principles

A professional analytics decision should be tested against several principles:

1. Autonomy and informed choice: people should understand significant data practices and have a genuine ability to choose.
2. Purpose limitation: data should be collected for specified, legitimate purposes rather than indefinite future use.
3. Proportionality: the intrusiveness of collection should be justified by the value and necessity of the intended outcome.
4. Beneficence and non-maleficence: analytics should create benefits while reducing foreseeable harm.
5. Justice and fairness: benefits and burdens should not be distributed through unjustified discrimination.
6. Accountability: an organisation should be able to explain who decided, what evidence was used and how risks were controlled.

These principles are useful even where legislation is absent, unclear or less demanding than responsible professional conduct.

2. Consent and data protection

Consent as a communication relationship

Consent is meaningful only when it is informed, specific, freely given, unambiguous and capable of being withdrawn. A pre-ticked box, a confusing banner or a service that cannot reasonably be used without unrelated tracking may produce a recorded action without producing meaningful consent.

A good consent interface should:

• identify the organisation and relevant partners;
• describe purposes in plain language;
• distinguish necessary processing from optional analytics and advertising;
• avoid bundling unrelated purposes;
• provide a refusal option that is as visible as acceptance;
• record the version, time, purposes and wording presented;
• make withdrawal easy and effective;
• avoid repeatedly pressuring people after refusal.

Consent is not always the appropriate legal or ethical basis. Depending on jurisdiction and context, processing may rely on contract necessity, legal obligation, vital interests, public interest or legitimate interests. Marketers must not label a practice “consent-based” merely because a platform has collected a signal. The organisation remains responsible for understanding the basis, purpose, scope and consequences of processing.

Data-protection lifecycle

Responsible data protection can be managed as a lifecycle:

1. Inventory: document what data are collected, from whom, where they go and who can access them.
2. Classify: distinguish personal, sensitive, confidential, public, pseudonymised and aggregated data.
3. Justify: define purpose, necessity, lawful basis and expected benefit.
4. Design: minimise fields, restrict access and build retention and deletion into systems.
5. Operate: monitor vendors, permissions, data quality, consent signals and incidents.
6. Review: test fairness, security, accessibility, user expectations and continuing necessity.
7. Dispose: delete or irreversibly anonymise data when the retention purpose ends.

Data minimisation means collecting only what is reasonably needed. If a campaign objective is to measure page-level engagement, collecting precise location or a person’s full contact history may be disproportionate. Retention should be linked to a documented business and legal need, not to the storage capacity of a platform.

Rights and transparency

Depending on applicable law, individuals may have rights to access, correction, deletion, restriction, portability, objection and information about automated decision-making. A privacy notice should explain categories of data, purposes, recipients, retention, rights and contact routes. It should be layered: a short explanation at the point of collection, supported by fuller detail for those who need it.

Transparency is not achieved by publishing a long document that no ordinary user can understand. The relevant question is whether a reasonable person can form an accurate view of what will happen and whether the practice would create an unexpected negative surprise.

3. Security for marketing analytics

Marketing teams often control tags, customer-data platforms, pixels, spreadsheets, dashboards and vendor integrations. Each is a potential route into sensitive systems.

Core controls include:

• multi-factor authentication and least-privilege access;
• role-based permissions for agencies, analysts and administrators;
• encryption in transit and at rest where appropriate;
• secure secrets management rather than passwords in code or spreadsheets;
• patching, vulnerability testing and dependency management;
• vendor due diligence and contractual security requirements;
• logging, monitoring and alerting for unusual exports;
• tested backups and incident-response procedures;
• separation of development, testing and production data;
• secure deletion and device-management controls.

A breach response should identify, contain and investigate the incident, preserve evidence, assess affected people and notify the relevant parties where required. Marketing staff should know how to escalate a suspected disclosure; they should not attempt to conceal it because of reputational concerns.

Security is also a data-quality issue. A malicious alteration to campaign or conversion data can lead to false budget decisions. Integrity checks, change logs and reconciliation between systems help protect both security and managerial judgement.

4. Accessibility and inclusive analytics

Accessibility means that people with different sensory, cognitive, physical and technological characteristics can perceive, understand, navigate and use a digital service. It is relevant to advertising destinations, consent tools, dashboards, research activities and customer communications.

Common failures include consent buttons that cannot be reached by keyboard, colour combinations with inadequate contrast, charts that communicate only through colour, videos without captions, rapidly changing interfaces, unlabeled form fields and error messages that do not explain how to recover.

Practical controls include semantic headings, keyboard navigation, visible focus indicators, alternative text where appropriate, captions and transcripts, sufficient contrast, scalable text, clear language and compatibility testing with assistive technologies. Accessibility should be tested with disabled users, not inferred solely from an automated checker.

Inclusive measurement also requires sampling discipline. If a website is difficult to use with screen readers or on low-bandwidth connections, observed conversion rates may reflect exclusion rather than customer preference. Accessibility is therefore both a rights issue and a validity issue.

5. Dark patterns and manipulative design

A dark pattern is an interface design that steers, pressures or deceives people into an action that may not reflect their considered preference. Examples include:

• making “accept all” prominent while hiding refusal;
• using emotionally loaded language to shame a refusal;
• preselecting optional tracking;
• confusing navigation that makes cancellation difficult;
• presenting a false countdown or misleading scarcity claim;
• requiring repeated steps to withdraw a choice;
• disguising advertising as neutral content.

The ethical test is not simply whether a user technically clicked. It is whether the design preserves comprehension, symmetry and genuine choice. A useful governance practice is to compare the effort, prominence, language and consequences of acceptance and refusal. Product teams should document experiments that affect consent or cancellation and require review before deployment.

Conversion optimisation must not be treated as an overriding objective. A short-term increase in consent or purchase completion can be offset by complaints, regulatory action, chargebacks, reputational damage and loss of trust.

6. Algorithmic fairness and responsible personalisation

Algorithms influence audience selection, bid optimisation, recommendations, fraud detection, lead scoring and content delivery. They may reproduce historical inequality even when protected characteristics are excluded. Proxy variables such as postcode, language, device type or browsing patterns can correlate with protected characteristics.

Fairness has no single universal definition. Relevant questions include:

• Representation: Are important groups adequately represented in training and evaluation data?
• Error distribution: Are false positives and false negatives concentrated in a group?
• Access: Does optimisation expose some groups to fewer opportunities or higher prices?
• Outcome: Do groups receive comparable benefits where comparable treatment is justified?
• Process: Can people understand, challenge or correct a consequential decision?

Several statistical measures are often used, but they answer different questions. For a group g, the positive prediction rate is:

where Ŷ is the predicted positive outcome and G identifies group membership. Similar rates across groups may indicate demographic parity, but parity alone can be inappropriate when legitimate base rates differ or when the prediction has a different meaning across groups.

The true-positive rate is:

where Y is the actual outcome. Equal opportunity seeks comparable true-positive rates across groups. The false-positive rate is:

These measures require reliable labels and representative evaluation data. They cannot by themselves establish that an algorithm is fair. Trade-offs can arise: improving one fairness measure may worsen another, particularly when groups have different outcome distributions. A marketing team should therefore define the relevant harm, affected population and decision context before selecting a metric.

A responsible model lifecycle includes problem definition, data assessment, feature review, subgroup testing, explainability, human oversight, deployment monitoring and appeal. Do not optimise only for aggregate return on advertising spend. Examine delivery, cost, quality and exclusion across relevant groups, while protecting sensitive information.

7. Analytics governance in practice

Governance is the allocation of decision rights, responsibilities, controls and escalation routes. It is not bureaucracy added after implementation. It determines whether an organisation can demonstrate that analytics is lawful, secure, accurate and aligned with its values.

A practical governance structure may include:

• a business owner accountable for purpose and outcomes;
• a privacy or data-protection specialist responsible for legal and rights analysis;
• security personnel responsible for technical safeguards;
• analysts responsible for documentation, quality and interpretation;
• marketing and product representatives responsible for user experience;
• procurement or legal teams responsible for vendors and contracts;
• an independent review or ethics group for high-risk uses.

A data and analytics register should record the asset, source, purpose, owner, lawful basis, data subjects, sensitivity, vendors, retention, access groups, model use, risks and review date. A data-protection impact assessment may be appropriate where processing is likely to create high risks, such as large-scale profiling, sensitive data use or systematic monitoring.

Governance controls should be proportionate to risk. A basic campaign report may need routine access and retention checks. Automated eligibility, health-related targeting or high-scale behavioural profiling requires stronger review, testing, documentation and human accountability.

A useful approval sequence is:

1. What decision or customer benefit is intended?
2. What data are strictly necessary?
3. What could surprise, exclude or harm people?
4. What legal basis, notice and choice apply?
5. What security and vendor controls are required?
6. How will accuracy, fairness and accessibility be tested?
7. Who can approve, pause or stop the system?
8. What evidence will be retained for audit and learning?

8. Measurement after third-party cookies

Third-party cookies historically enabled cross-site recognition, audience building, attribution and frequency management. Browser restrictions, platform policies, regulatory pressure and changing user expectations have reduced their reliability. The result is not the end of measurement but a shift toward more direct, aggregated and consent-aware methods.

Important alternatives include:

• First-party data: information collected directly through a relationship, such as authenticated purchases or voluntarily supplied preferences.
• Contextual measurement: connects advertising to the content or context in which it appears rather than tracking an individual across sites.
• First-party analytics: measures activity within an organisation’s own digital properties, subject to consent and configuration requirements.
• Server-side collection: moves some processing from a browser to controlled servers; it can improve governance but does not remove legal obligations or make tracking invisible.
• Modeled conversions: estimates outcomes when observable signals are incomplete. Models require documented assumptions and uncertainty communication.
• Media mix modelling (MMM): uses aggregate time-series data such as spend, sales, seasonality and promotions to estimate channel contribution. It is less dependent on individual-level identifiers but needs sufficient variation, careful controls and stable data quality.
• Incrementality testing: compares outcomes for treatment and control groups, or uses geo-based experiments, to estimate the causal effect of marketing rather than relying only on correlation.

Attribution is not the same as causation. A platform may assign credit to an interaction that occurred before a purchase without proving that the interaction caused the purchase. Privacy-aware measurement should place greater emphasis on experiments, aggregate analysis, transparent assumptions and business outcomes.

9. Privacy-enhancing technologies and clean rooms

Privacy-enhancing technologies are technical methods intended to reduce exposure of identifiable data while preserving useful analysis. Examples include:

• Aggregation: reporting groups rather than individuals;
• Pseudonymisation: replacing identifiers with controlled tokens;
• Differential privacy: adding carefully calibrated statistical noise so that the presence or contribution of one person has limited influence on a released result;
• Secure multiparty computation: allowing parties to compute jointly without revealing their private inputs;
• Federated learning: training models across distributed data while keeping raw data at local sites;
• Encryption and access controls: limiting exposure during storage, transfer and processing.

PETs involve trade-offs. Noise can reduce accuracy, federated systems can be complex to secure, and pseudonymised data may remain personal data. PETs reduce risk; they do not automatically make a purpose legitimate.

A data clean room is a controlled environment in which organisations compare or analyse datasets under restrictions on access, export and identification. For example, a retailer and an advertising platform may calculate aggregated overlap or conversion results without either party receiving the other’s raw customer list. Clean rooms can support campaign measurement and audience analysis, but their protection depends on identity resolution, minimum group sizes, query controls, contractual limits, auditing and resistance to differencing attacks. A clean room is not a guarantee of anonymity and should be assessed as a governance system, not marketed as a magic privacy solution.

10. Emerging developments and strategic implications

Several developments are reshaping analytics:

• Generative AI: can summarise data, create audience hypotheses and automate reporting, but may expose confidential information, invent explanations or reproduce bias. Human review, approved tools and prompt/data controls are essential.
• Synthetic data: can support testing and development, but synthetic records may preserve the biases of the source or be vulnerable to inference if generated poorly.
• Digital identity and consent signals: may improve continuity across devices, but centralised identity can increase surveillance and exclusion risks.
• Edge and on-device analytics: process data closer to the user and can reduce transmission of raw events, although local processing still requires an appropriate purpose and secure implementation.
• Regulatory convergence and divergence: privacy, AI, consumer-protection, accessibility and cybersecurity rules increasingly overlap, while requirements differ across countries and sectors.
• Data clean rooms and retail media: expand collaboration between advertisers, retailers and platforms, increasing both measurement opportunities and the need for independent scrutiny.

The strategic direction is toward data minimisation, authenticated or consented relationships, aggregate measurement, experimentation and demonstrable accountability. Organisations that treat privacy as a constraint to evade will continually rebuild fragile measurement systems. Organisations that treat it as a design requirement can create more resilient and trusted analytics.

Applied case: illustrative scenario—Northstar Retail

Background

Northstar Retail, an online and physical retailer, uses a mobile app, website, email programme and advertising platforms. Its marketing team wants to connect browsing behaviour, loyalty purchases and advertising exposure to improve personalisation and allocate budget.

Problem

The existing system stores device identifiers indefinitely, shares detailed event data with several vendors and uses a consent banner with a prominent “accept” button and a low-visibility settings link. The company cannot reliably explain which customers were included in advertising audiences. An automated bidding system delivers fewer high-value product advertisements to older customers and to people using lower-cost devices. A security review also finds shared administrator accounts.

Analysis

The problems are interconnected. Excessive retention increases breach impact. Weak consent design undermines the legitimacy of optional processing. Shared accounts prevent accountability. Device type may act as a proxy for income or age, creating a fairness risk. The optimisation result may reflect historical conversion patterns rather than genuine customer value. The company also risks measuring platform-assigned attribution as if it were causal impact.

Approach and solution

Northstar establishes a cross-functional governance group and creates a data register. It separates necessary service processing from optional analytics and advertising, redesigns the consent interface symmetrically, records consent evidence and provides an accessible withdrawal route. It removes unnecessary fields, establishes retention periods and uses role-based access with multi-factor authentication.

For measurement, Northstar prioritises first-party transaction data, contextual advertising, aggregate reporting and incrementality tests. It uses a clean room for selected partner analyses with minimum audience thresholds and prohibits exporting row-level data. Its modelling team evaluates delivery and error patterns across relevant groups, removes unjustified proxy features and adds human review for high-impact decisions. Dashboards show uncertainty and distinguish observed from modelled conversions.

Outcome

The new system produces less individual-level data but clearer evidence. Some short-term audience reach falls, and reporting becomes less granular. However, access is auditable, refusal is respected, campaign experiments provide stronger causal evidence, and marketing leaders can explain the basis of major decisions. The organisation also detects that one apparently successful audience segment produced little incremental sales when tested against a control group.

Learning points

1. Privacy controls can improve measurement quality by reducing duplicated, low-quality and unauthorised data.
2. A clean room is useful only when supported by restrictions, thresholds and audits.
3. Fairness must be tested in the actual delivery context, not inferred from model intent.
4. Governance requires named owners, documented evidence and authority to stop a risky practice.
5. Less granular data can support better strategic decisions when causal methods replace superficial attribution.

Challenges and limitations

Responsible analytics involves genuine tensions. Strict minimisation may reduce personalisation. Aggregation can hide small but important groups. Anonymisation can reduce utility, while detailed data can increase risk. Fairness criteria may conflict, and excluding protected attributes can make monitoring more difficult. Consent may become repetitive or ineffective when users face many interfaces. Small organisations may lack specialist legal and technical resources.

These limitations do not justify abandoning governance. They require explicit trade-offs, proportional controls and review. Decisions should record what was sacrificed, why the choice was reasonable, who may be harmed and when the decision will be reconsidered.

Best-practice checklist

Before launching an analytics or marketing initiative, confirm that:

• the purpose and expected benefit are specific;
• data fields are necessary and retention is justified;
• consent and notices are understandable and accessible;
• refusal and withdrawal are genuinely practical;
• vendors, transfers and permissions are documented;
• security controls and incident routes are tested;
• models are evaluated for data quality and subgroup impacts;
• dashboards distinguish measured, inferred and modelled results;
• experiments are used where causal claims matter;
• a named owner can pause or terminate the system;
• evidence is retained for audit, correction and learning.

Chapter Summary

Privacy, ethics and governance are central to credible digital analytics. Privacy concerns control and reasonable expectations; data protection governs processing; security protects confidentiality, integrity and availability; ethics evaluates autonomy, harm, justice and accountability. Meaningful consent requires clear information, genuine choice and easy withdrawal, while data minimisation, purpose limitation, retention controls and transparency reduce unnecessary risk.

Security must cover identity, access, vendors, monitoring and incident response. Accessibility protects participation and improves measurement validity. Dark patterns undermine informed choice even when users technically click. Algorithmic fairness requires context-specific definitions, subgroup testing, human oversight and recognition that fairness measures can conflict.

Governance assigns ownership and creates registers, assessments, controls, review and escalation. As third-party cookies decline, organisations are moving toward first-party relationships, contextual methods, aggregate analysis, media mix modelling and incrementality testing. Privacy-enhancing technologies and clean rooms can reduce exposure but do not remove legal or ethical responsibilities. The future of analytics will favour organisations that combine useful evidence with minimisation, causal reasoning, security and demonstrable accountability.

Key Terms

Privacy: A person’s ability to control information about themselves and avoid unjustified observation.

Personal data: Information relating to an identified or identifiable person.

Pseudonymisation: Replacing direct identifiers with codes while retaining a possibility of re-identification.

Anonymisation: Processing intended to make identification reasonably infeasible.

Consent: A specific, informed, freely given and unambiguous indication of agreement.

Purpose limitation: Using data only for specified and legitimate purposes.

Data minimisation: Collecting and using no more data than reasonably necessary.

Retention: The period for which data are stored and needed.

Confidentiality: Preventing unauthorised disclosure.

Integrity: Protecting data from unauthorised alteration.

Availability: Ensuring authorised access when needed.

Dark pattern: A design that manipulates or deceives users into an action.

Accessibility: Designing services so people with diverse abilities can use them.

Algorithmic fairness: The assessment and control of unjustified disparities in automated systems.

Differential privacy: A method that limits the influence of any one person on a released result through calibrated statistical protection.

Clean room: A controlled environment for analysing combined data without exposing raw records.

Incrementality: The additional outcome caused by a marketing intervention.

Media mix modelling: Aggregate statistical analysis estimating channel contribution over time.

Governance: The structures, responsibilities and controls used to direct and oversee analytics.

Data-protection impact assessment: A structured evaluation of privacy risks and mitigations for a processing activity.

Review Questions

5 Short Answer Questions

1. Distinguish privacy, data protection and security.
2. What conditions make consent meaningful?
3. Give three examples of dark patterns.
4. Why does pseudonymisation not necessarily make data anonymous?
5. State two advantages and one limitation of clean rooms.

5 Long Answer Questions

1. Explain how data minimisation, purpose limitation and retention controls work together across the analytics lifecycle.
2. Discuss the security responsibilities of a digital marketing team managing tags, dashboards and vendor integrations.
3. Explain why accessibility is both an ethical requirement and a measurement-quality issue.
4. Compare demographic parity, equal opportunity and false-positive-rate analysis in algorithmic fairness.
5. Evaluate how the decline of third-party cookies changes measurement strategy.

3 Analytical / Application Questions

1. A retailer’s consent banner produces a high acceptance rate but makes refusal difficult. Diagnose the ethical and governance problems and propose a redesigned process.
2. An advertising model delivers fewer premium offers to users on budget devices. Design an investigation covering data quality, proxy discrimination, fairness testing and corrective action.
3. A brand wants to combine retailer and platform data in a clean room. Recommend technical, contractual and analytical controls, and explain what claims the resulting measurement can and cannot support.

Multiple Choice Questions with Answers

Question 1

Which statement best distinguishes security from privacy?

A. Security concerns protecting information and systems; privacy concerns appropriate control and use of information about people.

B. Security is only about legal compliance; privacy is only about encryption.

C. Security applies only to anonymous data; privacy applies only to passwords.

D. Security and privacy are identical terms with no practical distinction.

Correct Answer: A. Security concerns protecting information and systems; privacy concerns appropriate control and use of information about people.

Question 2

Which practice most clearly supports meaningful consent?

A. Preselecting all optional advertising purposes

B. Making refusal less visible than acceptance

C. Explaining purposes clearly and providing an equally practical withdrawal route

D. Recording a click without recording the information shown to the user

Correct Answer: C. Explaining purposes clearly and providing an equally practical withdrawal route

Question 3

What is a dark pattern?

A. A statistical technique for removing outliers

B. An interface design that manipulates or deceives users into an action

C. A security control that hides passwords

D. A method for anonymising customer records

Correct Answer: B. An interface design that manipulates or deceives users into an action

Question 4

Why is accessibility relevant to analytics validity?

A. Inaccessible services can exclude users, making observed behaviour unrepresentative.

B. Accessibility removes the need for data protection.

C. Accessibility guarantees that every algorithm is fair.

D. Accessible interfaces always produce higher conversion rates.

Correct Answer: A. Inaccessible services can exclude users, making observed behaviour unrepresentative.

Question 5

In the expression TPR_g = P(Ŷ = 1 | Y = 1, G = g), what does TPR measure?

A. The proportion of all group members receiving a positive prediction

B. The probability of a positive prediction among people with the actual positive outcome in group g

C. The proportion of negative outcomes incorrectly predicted as positive

D. The total number of records in group g

Correct Answer: B. The probability of a positive prediction among people with the actual positive outcome in group g

Question 6

Which statement about excluding protected characteristics from a model is most accurate?

A. It guarantees that the model cannot discriminate.

B. It may still discriminate because other variables can act as proxies.

C. It makes subgroup fairness testing impossible and therefore unnecessary.

D. It automatically creates demographic parity.

Correct Answer: B. It may still discriminate because other variables can act as proxies.

Question 7

Which approach is most directly designed to estimate causal marketing impact?

A. Counting every platform touchpoint as a conversion

B. Increasing the attribution window

C. Running an incrementality test with a suitable control group

D. Using only the last-click report

Correct Answer: C. Running an incrementality test with a suitable control group

Question 8

What is a key limitation of pseudonymisation?

A. Pseudonymised data can never be analysed.

B. Pseudonymised data may still be linked to an identifiable person.

C. Pseudonymisation always destroys data integrity.

D. Pseudonymisation prevents access control.

Correct Answer: B. Pseudonymised data may still be linked to an identifiable person.

Question 9

Which statement best describes a data clean room?

A. A public database containing all customer records

B. A controlled environment for analysing datasets under restrictions on access and export

C. A tool that automatically makes all data anonymous

D. A replacement for security, contracts and privacy governance

Correct Answer: B. A controlled environment for analysing datasets under restrictions on access and export

Question 10

Which governance practice most improves accountability?

A. Allowing shared administrator accounts for convenience

B. Keeping purposes undocumented so systems remain flexible

C. Assigning named owners and recording purposes, access, retention and review evidence

D. Deleting all audit logs after each campaign

Correct Answer: C. Assigning named owners and recording purposes, access, retention and review evidence