Data Migration with Outdated Documentation: What Should Be Done Next?
Short answer
A Review data flow post migration.
Question
Key Takeaways
The question tests your ability to sequence privacy operations: classification is a prerequisite that must occur before migration, while review after migration is too late.
When senior management approves a personal-data migration from a poorly documented source, the next step is to ensure appropriate data classification before moving forward. Community consensus favors classification first rather than a post-migration review.
Common mistake: Choosing A, 'Review data flow post migration' is the most common mistake because it sounds like a thorough follow-up, but it happens after the migration, not as the NEXT step.
Expert Analysis
Why the Answer Is Correct
Option B, "Ensure appropriate data classification," is the correct next step. When a data source has outdated documentation, you do not reliably know what personal data it contains, its sensitivity, or its handling requirements. Before migrating personal data, you must classify it so that appropriate protections and controls can be applied during and after the migration. Senior approval does not remove the obligation to identify and classify personal data.
Why the Other Options Are Wrong
Option A, "Review data flow post migration," is a valid verification activity but it occurs after the migration, so it cannot be the NEXT step. Option C, engaging an external auditor, is not automatically necessary and would be premature before classification. Option D, checking version history, only helps understand documentation changes; it does not address the content, sensitivity, or classification of the personal data being migrated.
Community Comment Notes
Commenters favoring B correctly point out that the migration has not yet occurred, so classification should happen first. One comment states: "The migration hasn't occurred yet. So, I think we should ensure appropriate data classification FIRST before we move forward with migration. Then and only then we can do A." Another comment independently selects B, reinforcing the consensus. A single comment selecting A misses the timing context, which is the central trap in this question.
Official Reference
https://www.isaca.org/credentialing/cdpse
This link opens the official vendor documentation in a new tab.
Exam Strategy
For any "what should be done NEXT" question, evaluate the timing of each answer option. Eliminate actions that can only logically occur after the event described, and choose the action that is a necessary prerequisite for safely handling personal data.
Community Votes
50% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 3 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 3
-
shiowbah 👍 2B. Ensure appropriate data classification.
-
4dfe785 👍 1 Answered BThe migration hasn't occurred yet. So, I think we should ensure appropriate data classification FIRST before we move forward with migration. Then and only then we can do A.
-
ARaghunanan 👍 1 Answered AEnsuring the data migration was successful is determined by a review post migration.
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.
Related Analysis
Practice All CDPSE Questions
Access 229 questions with complete answers and detailed explanations.
View Full CDPSE Practice Test →