Privacy Code Principle: Challenging compliance — what does it say?

• A. Compliance cannot be challenged.
• B. There is no mechanism to challenge.
• C. Individuals may challenge an organization's compliance and the organization must respond.
• D. Only legal action can challenge.

Answer: (C)

Challenging compliance means there’s a formal pathway for someone to question how an organization handles their personal information, and the organization is obligated to respond to that challenge. When a concern is raised, the organization’s privacy officer or the appropriate regulator reviews the issue, acknowledges the complaint, and conducts an internal assessment. The organization then provides a written response explaining the findings and any steps it will take to address non-compliance or, if appropriate, to maintain current practices. This process ensures accountability and protects individuals’ privacy rights by making sure concerns aren’t ignored and that there’s a concrete plan to remedy issues. It’s not about avoiding questions or only pursuing legal action—the code explicitly supports a mechanism for challenges and requires a reply from the organization.