CDPSE Privacy Governance — 20 Questions

Question 1

In the context of the NIST Privacy Framework, what is the primary role of the 'Govern' (GV) function?

Accepted Answer

Communicating privacy risks to stakeholders.. In the NIST Privacy Framework, the Govern (GV) function establishes and communicates the organization's privacy risk management strategy, including roles, responsibilities, and how privacy risk is communicated to stakeholders. It is the foundational function that sets policy and ensures accountability across the other functions (Identify, Control, Communicate, Protect). Communicating privacy risks to stakeholders is therefore a core GV activity.

Answer

Creating data erasure requests.

Answer

Detecting privacy breaches.

Answer

Implementing technical access controls.

Answer

Archiving personal data.

Question 2

When designing a privacy incident response plan, who should be the primary decision-maker for reporting a breach to a regulator?

Accepted Answer

The Data Protection Officer (DPO).. The Data Protection Officer (DPO) is the role charged with advising on and monitoring compliance with data protection law, including assessing whether a breach triggers regulatory notification obligations. The DPO typically leads the decision framework for reporting, coordinating with legal and executive leadership, because they hold the specialized knowledge of notification thresholds and timelines. This makes the DPO the primary decision-maker for regulator reporting.

Answer

The software vendor.

Answer

The office administrator.

Answer

The social media manager.

Question 3

Which TWO of the following are effective ways to measure the success of a privacy program?

Accepted Answer

Reduction in the number of privacy-related incidents.. Option A is correct because a reduction in the number of privacy-related incidents is a direct, quantifiable outcome metric that demonstrates the privacy program is preventing data breaches, unauthorized disclosures, and policy violations, showing measurable risk reduction over time. Option B is correct because successful completion of internal and external privacy audits verifies that the program's controls, policies, and procedures conform to frameworks such as GDPR, HIPAA, or ISO/IEC 27701, providing independent assurance of compliance and operational effectiveness. Options C, D, and E are incorrect because the color of office walls, the number of coffee machines, and the number of office chairs purchased are unrelated to privacy controls, data protection outcomes, or regulatory compliance, and therefore cannot serve as valid success measures for a privacy program.

Answer

The color of the office walls.

Answer

The number of coffee machines in the breakroom.

Answer

How many office chairs are purchased.

Question 4

A multinational financial services firm is updating its privacy governance program to address increasing regulatory scrutiny. The Chief Privacy Officer must ensure that the program includes mechanisms for accountability and enforcement. Which TWO of the following are essential components for achieving this? (Choose two.)

Accepted Answer

A privacy incident response plan that includes disciplinary actions for violations.. Defined roles and responsibilities establish who is accountable for privacy, while an incident response plan with disciplinary actions provides enforcement. Together, they create a governance structure where privacy obligations are clearly owned and violations have consequences, ensuring the program can be effectively enforced.

Answer

A privacy budget allocated to the marketing department.

Answer

Annual privacy training for all employees.

Answer

Regular privacy awareness campaigns for customers.

Question 5

A global technology company is establishing a privacy governance program to comply with multiple privacy regulations across different regions. The Chief Privacy Officer is identifying key roles and responsibilities to ensure clear accountability and effective oversight. Which TWO of the following are essential roles that should be defined within the privacy governance program? (Choose two.)

Accepted Answer

A Privacy Steering Committee composed of cross-functional executives to provide strategic direction and oversight. The DPO and the Privacy Steering Committee are essential roles in a privacy governance program. The DPO ensures regulatory compliance and acts as a liaison with authorities, while the steering committee provides strategic oversight and cross-functional alignment. Together, they establish clear accountability and direction for the privacy program, which is vital for managing complex, multi-jurisdictional privacy requirements.

Answer

A Data Steward responsible for the day-to-day management of data quality and metadata

Answer

A Privacy Program Manager responsible for implementing privacy policies and managing privacy operations

Answer

A Chief Information Security Officer (CISO) responsible for implementing technical security controls to protect personal data

Question 6

Which governance structure is most appropriate for a decentralized organization managing privacy risks?

Accepted Answer

Hub-and-spoke model with localized privacy champions.. A hub-and-spoke model with localized privacy champions is most appropriate for a decentralized organization because it balances central oversight (hub) with local implementation (spokes). This structure ensures consistent privacy policies while allowing flexibility for regional differences and fostering accountability at the local level.

Answer

Ad-hoc committee based on project needs.

Answer

Outsourcing all privacy functions.

Answer

Centralized command-and-control structure.

Question 7

Which document should a CDPSE practitioner review first when establishing a new privacy governance program?

Accepted Answer

The existing business strategy and risk appetite.. A privacy governance program must be aligned with the organization's strategic direction and risk tolerance, so the first document to review is the existing business strategy and risk appetite. This establishes why the program exists, what business outcomes it must support, and how much privacy risk leadership is willing to accept. Without that context, a practitioner cannot prioritize regulatory obligations, allocate resources, or define meaningful metrics.

Answer

The list of current vendors.

Answer

The software inventory.

Answer

The technical architecture diagram.

Question 8

A company is moving to a cloud-based SaaS environment. Who retains the primary responsibility for privacy governance?

Accepted Answer

The Data Controller (the company).. In a cloud-based SaaS environment, the Data Controller (the company) retains primary responsibility for privacy governance. Under GDPR, the controller determines the purposes and means of processing personal data and is accountable for compliance, even when using a Cloud Service Provider (CSP) as a processor. The CSP acts on behalf of the controller and provides technical safeguards, but the ultimate responsibility remains with the controller.

Answer

The individual data subjects.

Answer

The Lead Supervisory Authority.

Answer

The Network Infrastructure team.

Answer

The Cloud Service Provider (CSP).

Question 9

When aligning privacy strategy with business objectives, what is the primary metric to demonstrate the value of a privacy program to stakeholders?

Accepted Answer

Reduction in privacy-related regulatory non-compliance fines.. Reduction in privacy-related regulatory non-compliance fines is the primary metric that demonstrates the value of a privacy program to stakeholders because it directly ties privacy efforts to financial risk mitigation and business outcomes. Stakeholders care about avoided costs and regulatory penalties, making this a quantifiable business value metric. Training sessions, tool spend, and patch counts are activity metrics, not outcome metrics.

Answer

Count of privacy training sessions completed.

Answer

Total spend on privacy software tools.

Answer

Number of privacy patches applied.

Question 10

You are mapping personal data flows for a global enterprise. Which approach is most effective for demonstrating accountability under GDPR?

Accepted Answer

Maintaining a comprehensive Record of Processing Activities (ROPA).. A Record of Processing Activities (ROPA) is the primary accountability artifact under GDPR Article 30, documenting what personal data is processed, why, by whom, where, and for how long. Maintaining a comprehensive ROPA demonstrates accountability because it provides the authoritative map of data flows that regulators, DPOs, and auditors rely on to verify lawful processing. It is the foundational document that supports DPIAs, DSAR responses, and breach assessments.

Answer

Conducting periodic penetration tests.

Answer

Updating the external privacy policy annually.

Answer

Signing NDAs with all employees.

Question 11

A multinational company intends to implement a Global Privacy Policy. What is the greatest challenge to its effective governance?

Accepted Answer

Incompatible local regulatory mandates.. A Global Privacy Policy must satisfy every jurisdiction in which the company operates, and local privacy laws frequently impose conflicting requirements — for example, GDPR's data subject rights versus CCPA's opt-out model versus sectoral rules in healthcare or finance. These incompatible mandates create genuine legal conflicts that cannot be resolved by a single uniform policy without local addenda or derogations. This is the greatest governance challenge because it forces ongoing legal reconciliation rather than a one-time drafting exercise.

Answer

Lack of translation services.

Answer

Difficulty in choosing a document management system.

Answer

Inability to find a privacy officer for every region.

Answer

Resistance from the Marketing department.

Question 12

A CDPSE practitioner is integrating privacy controls into the SDLC. Which action best ensures privacy by design during the requirements gathering phase?

Accepted Answer

Conducting a privacy impact assessment on functional requirements.. Conducting a privacy impact assessment (PIA) or data protection impact assessment (DPIA) on functional requirements during requirements gathering embeds privacy by design at the earliest point, when changes are cheapest and most effective. It identifies how personal data will be collected, used, shared, and retained before any code is written, allowing privacy requirements to be specified alongside functional ones. This satisfies GDPR Article 25 (data protection by design and by default) and the CDPSE principle of integrating privacy into the SDLC from the start.

Answer

Installing a firewall after code completion.

Answer

Reviewing audit logs after the system launch.

Answer

Performing a DPIA after production deployment.

Question 13

What is the primary role of a Data Privacy Officer (DPO)?

Accepted Answer

Monitoring compliance and providing advice on data protection.. The DPO's primary role is to monitor compliance with data protection laws and internal policies, and to advise the organization and its employees on data protection obligations. This is an advisory and monitoring function, not an operational or executive decision-making role. It is defined explicitly under GDPR Articles 37-39.

Answer

Approving all business marketing budgets.

Answer

Managing the IT server infrastructure.

Answer

Developing all corporate software applications.

Question 14

When establishing a privacy steering committee, who should be included to ensure organizational support?

Accepted Answer

Senior representatives from Legal, IT, HR, and Marketing.. A privacy steering committee should include senior representatives from key stakeholder groups such as Legal, IT, HR, and Marketing to ensure diverse perspectives and organizational buy-in. This cross-functional representation ensures that privacy decisions consider legal requirements, technical feasibility, employee data, and customer-facing activities. Limiting to one department would miss critical input.

Answer

Only the Human Resources team.

Answer

External consultants only.

Answer

Only the IT staff.

Question 15

Which of the following is the most effective method for evaluating the maturity of a privacy governance program?

Accepted Answer

Using an established Privacy Capability Maturity Model (PCMM).. A Privacy Capability Maturity Model (PCMM) provides a structured, repeatable framework with defined maturity levels (e.g., initial, managed, defined, quantitatively managed, optimizing) against which the governance program's processes, controls, and outcomes can be objectively assessed. It is the only option that evaluates the program holistically across dimensions like policy, training, monitoring, and continuous improvement. This makes it the most effective and defensible method for measuring maturity.

Answer

Checking for the presence of a Privacy Impact Assessment template.

Answer

Reviewing the number of cookies on the public website.

Answer

Asking employees if they like the privacy policy.

Question 16

Which governance artifact is best for documenting the accountability for privacy decisions?

Accepted Answer

A Privacy Decision Log.. A Privacy Decision Log is a governance artifact specifically designed to record privacy-related decisions, the rationale behind them, the accountable owner, and the date — providing traceability and accountability. It directly supports demonstrating who decided what and why, which is essential for regulatory defensibility and internal governance. This makes it the best fit for documenting accountability for privacy decisions.

Answer

An email thread.

Answer

A standard operating procedure (SOP).

Answer

The company's mission statement.

Question 17

When privacy governance is integrated into IT governance, what is the most significant benefit?

Accepted Answer

Improved visibility and efficiency of privacy controls.. Integrating privacy governance into IT governance yields improved visibility and efficiency of privacy controls because privacy requirements become part of standard IT processes, risk registers, and change management. This alignment ensures privacy controls are monitored, measured, and reported alongside other IT controls, reducing duplication and gaps. The result is more consistent enforcement and better evidence for audits and regulators.

Answer

Total replacement of the IT department.

Answer

Elimination of IT costs.

Answer

Simplification of external legal audits.

Question 18

Which governance mechanism is best suited for managing privacy risks in an agile development environment?

Accepted Answer

Appointing a privacy champion in each agile squad.. In agile environments, privacy risks are best managed by embedding a privacy champion within each squad so that privacy considerations are addressed continuously during refinement, design, and development. This decentralized model fits agile's iterative cadence and ensures privacy expertise is available at the point of decision rather than as a late-stage gate. It balances speed with accountability.

Answer

Requiring a full DPIA before every sprint.

Answer

Waiting for the security sign-off at the end of the project.

Answer

Hard-coding privacy requirements in the source code.

Question 19

When a conflict arises between business requirements and privacy principles, what should be the first step in the governance process?

Accepted Answer

Conduct a formal Privacy Impact Assessment (PIA).. A Privacy Impact Assessment (PIA) is the structured governance mechanism used to evaluate how a proposed processing activity affects individual privacy and to identify mitigations before the conflict escalates. When business requirements clash with privacy principles, the PIA provides an objective, documented analysis that lets governance bodies weigh risks, apply controls, or redesign the process rather than simply choosing one side. It is the recognized first step because it produces the evidence needed for any subsequent decision.

Answer

Ignore the privacy principle.

Answer

Ask the CEO to override the privacy policy.

Answer

Immediately terminate the project.

Question 20

Why is it important to have a defined data retention policy as part of privacy governance?

Accepted Answer

To comply with data minimization and reduce risk.. A defined data retention policy is important because it enforces data minimization by ensuring personal data is kept only as long as necessary for the stated purpose, thereby reducing privacy risk and regulatory exposure. It also supports compliance with laws like GDPR that require storage limitation. Saving costs or increasing storage are secondary benefits, not the primary privacy governance rationale.

Answer

To satisfy customer requests for free gifts.

Answer

To save costs on hardware maintenance.

Answer

To increase storage space.