CDPSE Privacy Governance — 15 Questions

Question 1

Which governance structure is most appropriate for a decentralized organization managing privacy risks?

Accepted Answer

Hub-and-spoke model with localized privacy champions.. Decentralized organizations benefit from a hub-and-spoke model.

Answer

Ad-hoc committee based on project needs.

Answer

Outsourcing all privacy functions.

Answer

Centralized command-and-control structure.

Question 2

Which document should a CDPSE practitioner review first when establishing a new privacy governance program?

Accepted Answer

The existing business strategy and risk appetite.. Organizational strategy defines the scope and objectives for privacy.

Answer

The list of current vendors.

Answer

The software inventory.

Answer

The technical architecture diagram.

Question 3

In the context of the NIST Privacy Framework, what is the primary role of the 'Govern' (GV) function?

Accepted Answer

Communicating privacy risks to stakeholders.. The GV function focuses on understanding organizational context and risk management strategy.

Answer

Creating data erasure requests.

Answer

Detecting privacy breaches.

Answer

Implementing technical access controls.

Answer

Archiving personal data.

Question 4

A company is moving to a cloud-based SaaS environment. Who retains the primary responsibility for privacy governance?

Accepted Answer

The Data Controller (the company).. The data controller remains accountable for data protection regardless of where it is processed.

Answer

The individual data subjects.

Answer

The Lead Supervisory Authority.

Answer

The Network Infrastructure team.

Answer

The Cloud Service Provider (CSP).

Question 5

When aligning privacy strategy with business objectives, what is the primary metric to demonstrate the value of a privacy program to stakeholders?

Accepted Answer

Reduction in privacy-related regulatory non-compliance fines.. Business value is best demonstrated through risk reduction and regulatory alignment.

Answer

Count of privacy training sessions completed.

Answer

Total spend on privacy software tools.

Answer

Number of privacy patches applied.

Question 6

You are mapping personal data flows for a global enterprise. Which approach is most effective for demonstrating accountability under GDPR?

Accepted Answer

Maintaining a comprehensive Record of Processing Activities (ROPA).. Accountability requires documented proof of processing activities.

Answer

Conducting periodic penetration tests.

Answer

Updating the external privacy policy annually.

Answer

Signing NDAs with all employees.

Question 7

A multinational company intends to implement a Global Privacy Policy. What is the greatest challenge to its effective governance?

Accepted Answer

Incompatible local regulatory mandates.. Conflicting local legal requirements often impede a single global policy.

Answer

Lack of translation services.

Answer

Difficulty in choosing a document management system.

Answer

Inability to find a privacy officer for every region.

Answer

Resistance from the Marketing department.

Question 8

A CDPSE practitioner is integrating privacy controls into the SDLC. Which action best ensures privacy by design during the requirements gathering phase?

Accepted Answer

Conducting a privacy impact assessment on functional requirements.. Privacy by design requires embedding privacy requirements early in the SDLC.

Answer

Installing a firewall after code completion.

Answer

Reviewing audit logs after the system launch.

Answer

Performing a DPIA after production deployment.

Question 9

What is the primary role of a Data Privacy Officer (DPO)?

Accepted Answer

Monitoring compliance and providing advice on data protection.. The DPO acts as an independent advisor and oversight function for privacy compliance.

Answer

Approving all business marketing budgets.

Answer

Managing the IT server infrastructure.

Answer

Developing all corporate software applications.

Question 10

When establishing a privacy steering committee, who should be included to ensure organizational support?

Accepted Answer

Senior representatives from Legal, IT, HR, and Marketing.. Executive sponsorship from cross-functional leadership is vital for authority.

Answer

Only the Human Resources team.

Answer

External consultants only.

Answer

Only the IT staff.

Question 11

Which of the following is the most effective method for evaluating the maturity of a privacy governance program?

Accepted Answer

Using an established Privacy Capability Maturity Model (PCMM).. Capability Maturity Models provide a structured approach to assessing maturity levels.

Answer

Checking for the presence of a Privacy Impact Assessment template.

Answer

Reviewing the number of cookies on the public website.

Answer

Asking employees if they like the privacy policy.

Question 12

Which governance artifact is best for documenting the accountability for privacy decisions?

Accepted Answer

A Privacy Decision Log.. A decision log provides a clear trail of who authorized specific privacy practices.

Answer

An email thread.

Answer

A standard operating procedure (SOP).

Answer

The company's mission statement.

Question 13

When privacy governance is integrated into IT governance, what is the most significant benefit?

Accepted Answer

Improved visibility and efficiency of privacy controls.. Integration ensures privacy is considered alongside other business goals, rather than as an afterthought.

Answer

Total replacement of the IT department.

Answer

Elimination of IT costs.

Answer

Simplification of external legal audits.

Question 14

Which governance mechanism is best suited for managing privacy risks in an agile development environment?

Accepted Answer

Appointing a privacy champion in each agile squad.. Privacy champions embedded in squads ensure privacy is addressed throughout the agile cycle.

Answer

Requiring a full DPIA before every sprint.

Answer

Waiting for the security sign-off at the end of the project.

Answer

Hard-coding privacy requirements in the source code.

Question 15

When a conflict arises between business requirements and privacy principles, what should be the first step in the governance process?

Accepted Answer

Conduct a formal Privacy Impact Assessment (PIA).. A structured risk assessment is necessary to weigh the business need against privacy risk.

Answer

Ignore the privacy principle.

Answer

Ask the CEO to override the privacy policy.

Answer

Immediately terminate the project.