A company adopts ISO/IEC 27001 but processes European Union residents' personal data. What is the best conclusion supported by the source?

### Why this is right The source explains that a generic baseline may not cover all statutory and regional requirements. It identifies the General Data Protection Regulation as a mandatory privacy regulation for enterprises processing or controlling personal data belonging to European Union citizens. ### The concept An enterprise should identify which obligations apply to its activities and incorporate them into an integrated framework. A baseline such as ISO/IEC 27001 can support security management, but it does not automatically satisfy every legal or sector-specific obligation. ### The other options - **B. The generic baseline automatically replaces all privacy regulations**: generic standards do not replace applicable law. - **C. The company should ignore privacy obligations unless an audit finds a breach**: obligations should be identified proactively, not only after a failure. - **D. The company must use only internal standards and discard external requirements**: the integrated framework combines relevant external requirements with internal standards. ### Terms - **ISO/IEC 27001**: an internationally adopted information security standards framework identified in the source. - **General Data Protection Regulation (GDPR)**: a European Union privacy regulation identified in the source. - **Statutory**: imposed by law. ### Remember Check applicability of legal and industry obligations in addition to adopting a general baseline.