Which statement about PII handling is accurate?

• A. PII should be safeguarded, minimized, and shared only on a need-to-know basis.
• B. PII should be posted publicly for transparency
• C. PII is not sensitive and can be shared freely
• D. PII should be ignored in daily operations

Answer: (A)

PII handling revolves around protecting information that could identify someone. The best practice is to safeguard PII, minimize how much you collect and keep, and share it only with people who need it to do their jobs. This reduces the risk of exposure, supports privacy protections, and helps meet legal and organizational requirements. In practice, you limit collection to what’s truly necessary, enforce strict access controls so only authorized individuals can view it, use encryption to protect it in transit and at rest, and maintain clear retention and disposal policies with audit trails.

Posting PII publicly or sharing it freely would unnecessarily expose individuals and violate privacy and security standards. Treating PII as non-sensitive and ignoring it would create real risk and potential legal or policy consequences.