CDPSE Flashcards — Free ISACA Certified Data Privacy Solutions Engineer (CDPSE) (CDPSE) Study Cards

SQL Dynamic Data Masking policies

Dynamic data masking (DDM) on SQL targets is a database-engine feature configured via SQL DDM policies, which mask column values at query time for non-privileged users without altering stored data. In Azure, this is enabled on Azure SQL Database, Azure SQL Managed Instance, and SQL Server via T-SQL (CREATE MASKED COLUMN) or the Azure portal's Dynamic Data Masking blade. Azure Data Factory itself does not apply DDM; it relies on the target SQL engine's masking policy.

Hub-and-spoke model with localized privacy champions.

A hub-and-spoke model with localized privacy champions is most appropriate for a decentralized organization because it balances central oversight (hub) with local implementation (spokes). This structure ensures consistent privacy policies while allowing flexibility for regional differences and fostering accountability at the local level.

Data minimization by requesting access to precise location only when necessary.

Data minimization is the foundational privacy principle that requires collecting only the personal data actually needed for a stated purpose. For geolocation, precise GPS coordinates are highly sensitive and intrusive, so the first question must be whether precise location is even necessary — coarse location or on-demand access may suffice. Applying minimization first reduces the scope of every downstream control (encryption, retention, disclosure), making it the correct starting point.

Retention Expiration Date

In BigID's data inventory, the Retention Expiration Date attribute records when a data asset's retention period ends, so filtering on it directly surfaces data that has exceeded its retention period. This is the purpose-built field for retention compliance workflows and is what privacy teams use to drive deletion or archival actions. Other attributes describe the data's identity, sensitivity, or storage, not its lifecycle timing.

Implement a policy-driven retention system that automatically enforces retention periods and triggers cryptographic erasure of expired records across all storage tiers, with audit logs.

A policy-driven retention system with cryptographic erasure automates enforcement and ensures irreversible disposal across all copies. It addresses the complexity of hybrid cloud environments by removing reliance on manual processes. Audit logs provide accountability. This approach aligns with legal retention requirements and data minimization principles.

To identify if training data is leaked

A Membership Inference Attack (MIA) attempts to determine whether a specific individual's data was part of a model's training set. Simulating MIA during testing helps identify if the model leaks information about its training data, which is a privacy risk. The goal is not to improve model performance but to assess and mitigate privacy leakage.

Explicit consent, obtained from users after providing clear information about the processing purposes.

Processing health data (heart rate, sleep) and precise location data falls under special categories of personal data under the GDPR, requiring a higher legal basis. Explicit consent is the most appropriate and commonly used basis for such processing, as it ensures individuals are fully informed and agree to the specific uses. Other legal bases like legitimate interests, contract performance, or vital interests are either insufficient or inapplicable for sensitive data in this context.

Row-level security (RLS) policies

Row-level security (RLS) policies are designed to restrict access to rows based on user attributes, such as role or department. This enables fine-grained access control, ensuring users only see data relevant to their role. Column-level encryption, views, and table-level RBAC do not provide dynamic row-level filtering per user, making them unsuitable for this requirement.

Automated deletion jobs triggered by data age

Automated deletion jobs are the correct control because they systematically remove personal data once the retention period expires, directly enforcing the storage limitation principle. Other controls may protect or restrict access to data but do not ensure its deletion. This makes automated deletion the best technical fit for the stated policy requirement.

A Data Protection Impact Assessment (DPIA) must be conducted because the processing involves systematic and extensive evaluation of personal aspects.

Automated profiling for credit decisions is high-risk processing under GDPR. Article 35(3)(a) specifically identifies systematic and extensive evaluation of personal aspects based on automated processing as a trigger for a DPIA. The DPIA must be completed before processing begins to identify and mitigate risks.

Programmatic propagation of the opt-out signal

For a CMP to honor an opt-out, the choice must be programmatically propagated to every downstream system, tag, SDK, or vendor that processes the user's data. A stored preference that never reaches ad tech, analytics, or CRM systems is functionally useless. Programmatic propagation (e.g., via consent strings, APIs, or tag managers) is what actually enforces the user's choice across the data ecosystem.

Conduct a formal Privacy Impact Assessment (PIA).

A Privacy Impact Assessment (PIA) is the structured governance mechanism used to evaluate how a proposed processing activity affects individual privacy and to identify mitigations before the conflict escalates. When business requirements clash with privacy principles, the PIA provides an objective, documented analysis that lets governance bodies weigh risks, apply controls, or redesign the process rather than simply choosing one side. It is the recognized first step because it produces the evidence needed for any subsequent decision.

Configure the pods to use an emptyDir volume with medium: Memory and ensure the application writes sensitive data only to that volume.

The correct approach uses an emptyDir volume with medium: Memory, which stores data in RAM and automatically deletes it when the pod terminates. This ensures that sensitive payment data is not written to persistent storage and is securely removed upon pod deletion, satisfying data minimization and disposal requirements. Other options involve persistent storage or insecure mechanisms that leave residual data.

Maintaining a comprehensive Record of Processing Activities (ROPA).

A Record of Processing Activities (ROPA) is the primary accountability artifact under GDPR Article 30, documenting what personal data is processed, why, by whom, where, and for how long. Maintaining a comprehensive ROPA demonstrates accountability because it provides the authoritative map of data flows that regulators, DPOs, and auditors rely on to verify lawful processing. It is the foundational document that supports DPIAs, DSAR responses, and breach assessments.

EventBridge Rule

Amazon Macie publishes findings to Amazon EventBridge, so configuring an EventBridge rule to match Macie finding events and route them to an SNS topic, Lambda, or ticketing system is the correct way to notify the privacy team. EventBridge is the native event-routing service that receives Macie's classification findings and can trigger downstream notifications. The other options are access-control, audit-logging, or storage-policy constructs, not notification mechanisms.

Data masking or using synthetic data sets.

Data masking and synthetic data sets protect personal data during testing by ensuring testers work with realistic but non-identifiable or fabricated records. Masking replaces sensitive fields (names, SSNs, card numbers) with fictitious values while preserving format and referential integrity, and synthetic data is generated from scratch so no real individual is represented. This satisfies privacy principles like data minimization and purpose limitation because production PII is never exposed in lower-trust test environments.

Consent

The correct basis is consent because the processing involves sharing personal data with third-party marketing partners, which is not necessary for contract performance or legal compliance, and legitimate interests would likely be overridden by data subject rights. Consent ensures individuals have control over their data and is explicitly required when data is used for marketing beyond the original purpose.

To verify the data was deleted securely

Chain of Custody documentation proves that data was handled, transferred, and destroyed by authorized parties without tampering or gaps. During disposal, it provides auditable evidence that the correct data was securely deleted at the right time by the right people, which is essential for regulatory compliance (GDPR, HIPAA, PCI DSS) and for defending against claims of improper destruction. Without it, an organization cannot demonstrate that disposal actually occurred as required.

Improved visibility and efficiency of privacy controls.

Integrating privacy governance into IT governance yields improved visibility and efficiency of privacy controls because privacy requirements become part of standard IT processes, risk registers, and change management. This alignment ensures privacy controls are monitored, measured, and reported alongside other IT controls, reducing duplication and gaps. The result is more consistent enforcement and better evidence for audits and regulators.

The right to audit the vendor's privacy and security controls.

The right to audit is the contractual mechanism that gives the CDPSE ongoing assurance that a third party's privacy and security controls actually operate as claimed. Without audit rights, the organization cannot independently verify vendor compliance, making it impossible to manage privacy risk effectively across the vendor lifecycle. This is a foundational third-party risk management control emphasized in privacy and security frameworks.

Establish a privacy steering committee that includes the Chief Privacy Officer and reports to the board of directors.

To influence decisions, the privacy program needs formal authority and a seat at the strategic table. A privacy steering committee that reports to the board provides that authority and ensures privacy is considered in high-level initiatives like health data analytics. It also facilitates escalation and resource allocation. Other options improve operations or awareness but do not change governance authority. Thus, the steering committee structure is the most direct enabler.

Implement privacy by design principles into the system development lifecycle and business process management.

Embedding privacy by design into the system development lifecycle and business process management ensures that privacy controls are built into operations from the start. This proactive approach makes privacy a default consideration, reducing the need for retroactive fixes and aligning with the objective of integrating privacy into business processes.