CDPSE Practice Test 10 — 10 Questions

Question 1

A small e-commerce company is creating a data retention schedule for its customer database. The privacy team wants to ensure that customer records are not kept longer than necessary. Which action should be taken first to establish an effective retention schedule?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Classify all customer data by type and sensitivity to determine appropriate retention periods.. An effective retention schedule begins with understanding the data. Classifying customer data by type and sensitivity allows the organization to assign retention periods based on legal requirements, business needs, and privacy risk. Without this foundation, retention decisions are arbitrary. Automated deletion, encryption, and archiving are either premature or unrelated to setting retention periods. Therefore, classification is the necessary first step.

Answer

Archive all customer records to a separate storage system for long-term preservation.

Answer

Encrypt the customer database to protect records from unauthorized access.

Answer

Implement automated deletion scripts that remove records after one year.

Question 2

A multinational retail corporation is updating its privacy governance framework to address new data protection regulations in multiple jurisdictions. The Chief Privacy Officer wants to ensure that the framework includes mechanisms for ongoing compliance monitoring and continuous improvement. Which of the following should be implemented FIRST to establish a foundation for effective monitoring?

Accepted Answer

Conduct a comprehensive data inventory and mapping exercise to identify all personal data flows. A comprehensive data inventory and mapping exercise is the essential first step because it provides the necessary visibility into personal data processing activities. This visibility enables the organization to identify compliance gaps, prioritize monitoring efforts, and implement effective controls. Without it, subsequent monitoring tools and governance structures lack the data they need to function effectively.

Answer

Establish a privacy steering committee to oversee compliance monitoring efforts

Answer

Implement a training program for all employees on privacy compliance requirements

Answer

Deploy a privacy management software platform to automate compliance tracking

Question 3

A healthcare organization is establishing a privacy governance framework. The Chief Privacy Officer wants to ensure that privacy policies are consistently applied across all departments. Which mechanism is most effective for achieving this consistency?

Accepted Answer

Implement a centralized privacy policy repository with mandatory training and periodic audits.. A centralized repository combined with training and audits ensures that all departments adhere to the same privacy policies. This approach provides clear guidance, reinforces expectations, and enables ongoing monitoring. It is the most effective way to achieve consistent application of privacy policies across a healthcare organization.

Answer

Delegate policy enforcement to department heads without central monitoring.

Answer

Allow each department to develop its own privacy policies based on its specific needs.

Answer

Rely on the legal department to review departmental policies only when a complaint is filed.

Question 4

A healthcare organization is revising its privacy governance structure after a series of data incidents involving unauthorized access by employees. The board wants to ensure accountability and reduce future risks. Which TWO of the following actions should be prioritized to strengthen governance? (Choose two.)

Accepted Answer

Establish a privacy steering committee that includes senior leaders from legal, IT, and clinical operations.. Mandatory role-based training and a cross-functional steering committee directly address the governance gaps that led to unauthorized access. Training reduces human error and builds awareness, while the committee ensures accountability and strategic oversight. Together, they create a stronger privacy culture and structure.

Answer

Increase the number of privacy impact assessments conducted annually.

Answer

Publish a revised privacy notice on the organization's website.

Answer

Delegate all privacy decision-making to the IT security department.

Question 5

A financial services company is implementing a new privacy governance framework. The Chief Privacy Officer wants to ensure that privacy risks are identified and addressed at the earliest stages of any new project. Which of the following approaches BEST integrates privacy into project management?

Accepted Answer

Embedding privacy requirements into the system development life cycle (SDLC). Embedding privacy into the SDLC is the most effective way to integrate privacy into project management because it makes privacy a continuous, structured component of every project phase. This ensures early risk identification and mitigation, whereas training, champions, or a single pre-initiation assessment are less systematic and may not address evolving risks.

Answer

Appointing a privacy champion in each business unit

Answer

Requiring a privacy impact assessment (PIA) before project initiation

Answer

Conducting annual privacy training for all project managers

Question 6

A small e-commerce company is creating its first privacy program. The CEO wants to ensure that privacy requirements are considered in all new projects from the start. Which governance mechanism is MOST appropriate to embed privacy by design?

Accepted Answer

Require a privacy impact assessment for every new project that involves personal data.. A privacy impact assessment is the most appropriate mechanism because it is a proactive, project-specific process that identifies and addresses privacy risks at the design stage. This aligns with the principle of privacy by design and ensures that privacy is built into systems and processes from the outset.

Answer

Conduct an annual privacy training session for all employees.

Answer

Appoint a privacy officer to review all projects after they are launched.

Answer

Include a privacy clause in all vendor contracts.

Question 7

A CDPSE is conducting a privacy risk assessment for a new cloud-based human resources (HR) system that will process employee personal data, including performance evaluations, disciplinary records, and health information for benefits administration. The system is hosted by a third-party vendor in a different jurisdiction. The CDPSE must identify the MOST significant privacy risk associated with this arrangement. Which of the following is the MOST critical risk to address?

Accepted Answer

The transfer of employee data to a different jurisdiction may lack a valid legal transfer mechanism, such as Standard Contractual Clauses or an adequacy decision.. The most significant privacy risk in this scenario is the potential lack of a valid legal transfer mechanism for moving employee data to a different jurisdiction. Without an adequacy decision, Standard Contractual Clauses, or another approved transfer tool, the processing violates GDPR Chapter V and similar laws. This risk is foundational because it affects the lawfulness of the entire HR system. Technical security, vendor misuse, and data subject rights are important but secondary to ensuring the transfer itself is legal.

Answer

The vendor may use employee data for its own marketing purposes without authorization.

Answer

The HR system may not provide employees with the ability to access and correct their personal data.

Answer

The vendor may not have sufficient technical security controls to protect data from external hackers.

Question 8

A CDPSE is reviewing the privacy program of a financial institution that operates in multiple countries. The institution has a centralized privacy policy but allows local branches to implement additional measures as needed. During an audit, the CDPSE finds that one branch has been using customer data for a new marketing campaign without updating the privacy notice or obtaining fresh consent. Which of the following actions should the CDPSE recommend FIRST to address this non-compliance?

Accepted Answer

Immediately suspend the marketing campaign and conduct a root cause analysis to determine how the deviation occurred.. The immediate priority when discovering non-compliant processing is to stop it to prevent further harm. Suspending the marketing campaign achieves this. A root cause analysis then identifies why the deviation occurred, enabling targeted corrective actions. Retroactive consent is invalid, breach reporting may be premature, and loosening the policy would exacerbate the problem. Therefore, containment and investigation are the correct first steps.

Answer

Report the branch's non-compliance to the relevant data protection authority as a personal data breach.

Answer

Revise the centralized privacy policy to allow branches more flexibility in using customer data for marketing.

Answer

Update the privacy notice to include the new marketing purpose and obtain retroactive consent from affected customers.

Question 9

A privacy steering committee is being established to oversee a company's privacy program. The committee must ensure that privacy risks are effectively managed across the organization. Which TWO of the following are the MOST important responsibilities of this committee? (Choose two.)

Accepted Answer

Reviewing and resolving escalated privacy issues and conflicts. The privacy steering committee is a governance body responsible for strategic direction, resource allocation, and resolving escalated privacy issues. It does not engage in operational tasks like daily monitoring, training material development, or technical assessments. By focusing on these high-level responsibilities, the committee ensures that privacy risks are managed consistently and that the program has the necessary support and authority.

Answer

Conducting daily monitoring of privacy compliance activities

Answer

Developing detailed privacy training materials for employees

Answer

Performing technical vulnerability assessments on privacy systems

Question 10

A technology company is expanding into new markets and needs to ensure its privacy governance program can scale. The privacy team is small and must prioritize activities. Which activity should be the first step in establishing governance for the new markets?

Accepted Answer

Conduct a data inventory and mapping exercise for the new markets to understand what personal data is collected and how it flows.. A data inventory and mapping exercise is the foundation of privacy governance. It provides the necessary understanding of data processing activities to develop policies, assign roles, and select tools. Without it, other activities are based on incomplete information. Therefore, it should be the first step when scaling governance to new markets.

Answer

Appoint a privacy lead in each new market before understanding the data landscape.

Answer

Implement a new privacy technology tool to automate compliance across all markets.

Answer

Draft new privacy policies for each new market based on assumptions about local laws.