How does data privacy legislation like GDPR/HIPAA influence IT governance?

• A. GDPR/HIPAA imposes strict data retention schedules.
• B. GDPR/HIPAA requires breach notification only.
• C. GDPR/HIPAA requires data protection, rights management, breach notification, and risk-based controls; shapes policies and incident response.
• D. GDPR/HIPAA has no impact on governance.

Answer: (C)

Data privacy laws push IT governance to embed privacy into how systems are designed, operated, and governed. They require privacy-by-design and privacy-by-default, so protections are built into applications, data flows, and processing activities from the start. They also mandate processes to honor individuals’ rights—such as access, correction, deletion, and data portability—so IT governance must manage consent, data subject requests, and policy enforcement across the organization. In addition, a formal breach notification process is required, with timely reporting to authorities and affected individuals when risks materialize. All of these aspects lead to a risk-based control approach, including data inventories, access control, encryption, logging and auditing, risk assessments, and vendor risk management. These elements shape the organization’s policies, procedures, and incident response plans, ensuring accountability and ongoing compliance. That’s why the answer describing data protection, rights management, breach notification, and risk-based controls—and how it influences policies and incident response—is the best fit.