What is the concept of risk acceptance and risk transference as described in Annex F?

• A. Acceptance means no action due to low risk; transference uses insurance or outsourcing to shift risk.
• B. Acceptance means buying insurance.
• C. Transference means avoiding risk entirely.
• D. Both are equivalent to data minimization.

Answer: (A)

Risk acceptance is when you decide not to take action to reduce a risk because it falls within your tolerance, while risk transference moves the potential impact to someone else—typically through insurance or outsourcing arrangements. The best answer captures this: acceptance means no action is taken due to low risk, and transference shifts risk to a third party via insurance or outsourcing. Buying insurance is a form of transference, not acceptance, and transference does not eliminate risk entirely. Data minimization is a separate concept and not the same as these approaches.