The Privacy Management Framework should maintain procedures for inquiries and complaints. Which option represents this requirement?

• A. Maintain procedures for inquiries and complaints
• B. Schedule annual retreats
• C. Approve travel expenses
• D. Maintain disaster recovery plan

Answer: (A)

A privacy program must have a formal process to handle inquiries and complaints from individuals about how their personal data is managed. Documented procedures ensure there is a consistent, timely, and auditable way to receive, log, investigate, and resolve privacy inquiries, with clear roles, escalation paths, and service levels. This directly fulfills the requirement because it creates a reliable mechanism for people to seek information or raise concerns and have them addressed. The other options—scheduling annual retreats, approving travel expenses, and maintaining a disaster recovery plan—pertain to operational activities or business continuity and do not address how inquiries and complaints about privacy are managed.