In the four-step PIA data inventory, which step defines scope, stakeholders, and resources?

• A. Plan
• B. Decide
• C. Populate
• D. Publish

Answer: (A)

Defining scope, stakeholders, and resources happens in the planning stage. This step sets up the project by outlining what will be included (the scope), who needs to be involved and accountable (stakeholders), and what is available to complete the work (resources such as people, budget, and tools). Establishing these boundaries and roles upfront ensures the privacy assessment covers the right data, includes the right approvals and expertise, and has the necessary support to proceed smoothly.

The other steps serve different purposes: deciding involves evaluating risks and choosing controls or next actions; populating is the actual collection and documentation of data assets, flows, and processing activities; publishing is about communicating findings and ensuring transparency.