Which practice helps protect privacy when handling incident information?

Which practice helps protect privacy when handling incident information?

• A. Publicly posting incident details on social media
• B. Sharing with any department that asks
• C. Saving data on personal devices
• D. Limiting access to authorized personnel and securely storing data

Answer: (D)

Protecting privacy means ensuring that only people who have a legitimate need to know incident information can access it, and that the information is stored in a secure, controlled environment. Limiting access to authorized personnel and securely storing data does exactly that: it uses access controls and secure systems to protect confidentiality, supports accountability with logs, and reduces the risk of exposure if devices are lost or stolen. It also aligns with proper data handling protocols like encryption, strong authentication, and approved storage methods. The other options introduce clear privacy risks. Posting incident details publicly on social media disseminates sensitive information beyond those who need to know. Sharing with any department that asks bypasses need-to-know protections, increasing exposure. Saving data on personal devices sidesteps organizational security controls, making data vulnerable to loss, theft, or improper handling.

Protecting privacy means ensuring that only people who have a legitimate need to know incident information can access it, and that the information is stored in a secure, controlled environment. Limiting access to authorized personnel and securely storing data does exactly that: it uses access controls and secure systems to protect confidentiality, supports accountability with logs, and reduces the risk of exposure if devices are lost or stolen. It also aligns with proper data handling protocols like encryption, strong authentication, and approved storage methods.

The other options introduce clear privacy risks. Posting incident details publicly on social media disseminates sensitive information beyond those who need to know. Sharing with any department that asks bypasses need-to-know protections, increasing exposure. Saving data on personal devices sidesteps organizational security controls, making data vulnerable to loss, theft, or improper handling.