Which of the following are the key factors that need to be considered for determining the applicability of the privacy principles? (Choose all that apply.)

Classify the following scenario as major or minor non-conformity.
"The organization has a very mature information security policy. Lately, the organization has realized the need to focus on protection of PI. A formal PI identification exercise was done for this purpose and a mapping of PI and security controls was done. The organization has also put in place data masking technology in certain functions where the SPI was accessed by employees of a third party. However, the organization is yet to include PI specifically in its risk assessment exercise, incident management, testing, data classification and security architecture programs."

Which of the following is the most effective way of ensuring the conformity to legalandregulations from the business functions, processes and relationships?

Which of the following is not an objective of VPI?

What is the maximum compensation that can be imposed on an organization for negligence in implementing reasonable security practices as defined in Section 43A of ITAA, 2008?