Which of the following is a recommended data-protection practice for PII?

• A. Limiting access to it
• B. Storing in unlocked cabinet
• C. Leaving printed PII on desk
• D. Sharing passwords

Answer: (A)

Controlling who can access PII is essential for protecting it. Limiting access means only people with a legitimate need–to–know can view or work with the information, which reduces the chance of accidental or intentional disclosure. This is the practice that embodies the principle of least privilege: give individuals the minimum access necessary to do their job and regularly review who has access.

The other options undermine protection: keeping data in an unlocked cabinet creates a physical security risk; leaving printed PII on a desk makes it easy for others to see or steal; and sharing passwords breaks authentication by allowing unauthorized people to impersonate authorized users.