If you suspect a privacy violation, what should you do first?

• A. Do nothing; privacy is not critical.
• B. Immediately report to the PN2 or designated privacy official and escalate.
• C. Only discuss with peers.
• D. Wait for the next audit.

Answer: (B)

The first action when you suspect a privacy violation is to report it to PN2 or the designated privacy official and escalate immediately. Doing this starts the formal review, helps contain any potential harm, and ensures the issue is handled through the proper channels with the right people taking ownership. It also creates an auditable record and aligns with policy and legal or regulatory requirements, so actions taken are consistent and defensible.

Other options delay or circumvent proper response. Doing nothing ignores the risk and violates responsibilities; discussing with peers without triggering official escalation may spread details and fail to initiate necessary containment or documentation; waiting for the next audit means potential harm could escalate and necessary controls might not be activated in time.