What is the proper PLM action in response to a privacy breach?

• A. Recommend a wait-and-see approach before contacting anyone.
• B. Only inform IT staff about the breach.
• C. Activate the incident response plan, notify affected consumers and regulators as required, and document remediation.
• D. Delete all records related to the breach to prevent further damage.

Answer: (C)

When a privacy breach occurs, the immediate priority is a coordinated, formal response. Activate the incident response plan to guide how the organization detects, contains, investigates, and recovers from the breach. Notify affected consumers and regulators as required by law or regulation, so those impacted can take protective steps and authorities can oversee the incident handling. Document the remediation actions taken and the lessons learned, creating an audit trail that supports accountability and helps prevent recurrence. This approach aligns with responsible risk management, regulatory requirements, and effective communication during incidents. Waiting or limiting disclosure to IT staff would miss mandatory stakeholder notification and could worsen regulatory and customer impact, while deleting records would obscure what happened and undermine compliance and investigation efforts.