Which practice is required by law and policy when handling personal information?

• A. Obtain consent
• B. Secure storage
• C. Minimize data collection
• D. Comply with laws and policies

Answer: (D)

What this is testing is the obligation to follow laws and organizational policies when handling personal information. The reason this is the best answer is that laws and policies set the rules for privacy, dictating what you may or may not do, how data must be protected, and what procedures must be followed. Following them ensures you stay compliant and accountable, regardless of the specific situation.

The other practices—obtaining consent, securing storage, and minimizing data collection—are important and often required in certain contexts, but they are actions that support compliance and are not universal rules by themselves. You follow laws and policies anyway, and those laws may require consent in some cases, mandate secure storage, or require minimizing data collection; the overarching requirement is to operate within the applicable legal and policy framework.