CDPSE Privacy Governance Practice Test 2 — 15 Questions

Question 1

Which governance artifact is best for documenting the accountability for privacy decisions?

Accepted Answer

A Privacy Decision Log.. A Privacy Decision Log is a governance artifact specifically designed to record privacy-related decisions, the rationale behind them, the accountable owner, and the date — providing traceability and accountability. It directly supports demonstrating who decided what and why, which is essential for regulatory defensibility and internal governance. This makes it the best fit for documenting accountability for privacy decisions.

Answer

An email thread.

Answer

A standard operating procedure (SOP).

Answer

The company's mission statement.

Question 2

When privacy governance is integrated into IT governance, what is the most significant benefit?

Accepted Answer

Improved visibility and efficiency of privacy controls.. Integrating privacy governance into IT governance yields improved visibility and efficiency of privacy controls because privacy requirements become part of standard IT processes, risk registers, and change management. This alignment ensures privacy controls are monitored, measured, and reported alongside other IT controls, reducing duplication and gaps. The result is more consistent enforcement and better evidence for audits and regulators.

Answer

Total replacement of the IT department.

Answer

Elimination of IT costs.

Answer

Simplification of external legal audits.

Question 3

Which governance mechanism is best suited for managing privacy risks in an agile development environment?

Accepted Answer

Appointing a privacy champion in each agile squad.. In agile environments, privacy risks are best managed by embedding a privacy champion within each squad so that privacy considerations are addressed continuously during refinement, design, and development. This decentralized model fits agile's iterative cadence and ensures privacy expertise is available at the point of decision rather than as a late-stage gate. It balances speed with accountability.

Answer

Requiring a full DPIA before every sprint.

Answer

Waiting for the security sign-off at the end of the project.

Answer

Hard-coding privacy requirements in the source code.

Question 4

When a conflict arises between business requirements and privacy principles, what should be the first step in the governance process?

Accepted Answer

Conduct a formal Privacy Impact Assessment (PIA).. A Privacy Impact Assessment (PIA) is the structured governance mechanism used to evaluate how a proposed processing activity affects individual privacy and to identify mitigations before the conflict escalates. When business requirements clash with privacy principles, the PIA provides an objective, documented analysis that lets governance bodies weigh risks, apply controls, or redesign the process rather than simply choosing one side. It is the recognized first step because it produces the evidence needed for any subsequent decision.

Answer

Ignore the privacy principle.

Answer

Ask the CEO to override the privacy policy.

Answer

Immediately terminate the project.

Question 5

Why is it important to have a defined data retention policy as part of privacy governance?

Accepted Answer

To comply with data minimization and reduce risk.. A defined data retention policy is important because it enforces data minimization by ensuring personal data is kept only as long as necessary for the stated purpose, thereby reducing privacy risk and regulatory exposure. It also supports compliance with laws like GDPR that require storage limitation. Saving costs or increasing storage are secondary benefits, not the primary privacy governance rationale.

Answer

To satisfy customer requests for free gifts.

Answer

To save costs on hardware maintenance.

Answer

To increase storage space.

Question 6

Which governance tool is used to demonstrate 'Privacy by Default'?

Accepted Answer

A set of design specifications showing restrictive default settings.. Privacy by Default under GDPR Article 25(2) requires that only personal data necessary for each specific purpose be processed by default. Demonstrating this requires documented design specifications showing that default settings are restrictive—for example, opt-in rather than opt-out, minimal data fields, and shortest retention periods. This is a governance artifact that proves the principle was applied at design time.

Answer

A firewall configuration report.

Answer

A customer feedback survey.

Answer

A list of employee names.

Question 7

What is the main purpose of a Privacy Impact Assessment (PIA) in the governance framework?

Accepted Answer

To identify and mitigate privacy risks early in the process.. A Privacy Impact Assessment (PIA) is a structured process to identify, evaluate, and mitigate privacy risks associated with a project, system, or process before it goes live. Its main purpose in a governance framework is to ensure that privacy risks are addressed early in the design phase, when changes are cheapest and most effective. This supports accountability and privacy by design requirements.

Answer

To calculate the financial costs of IT staff.

Answer

To increase the speed of product deployment.

Answer

To fulfill a mandatory public relations requirement.

Question 8

An organization is conducting a privacy maturity assessment. Which item represents the highest level of maturity in privacy policy development?

Accepted Answer

Policies that are embedded into automated workflows and continuously updated based on metrics.. The highest maturity level in privacy policy development is achieved when policies are embedded into automated workflows and continuously refined using metrics — this reflects an optimized, adaptive, and measurable governance process. This aligns with top levels of maturity models (e.g., CMMI Level 5 or the AICPA/CIPT maturity tiers) where processes are quantitatively managed and continuously improved. Automation ensures consistent enforcement, while metrics drive evidence-based updates.

Answer

An annual policy review conducted by the legal team.

Answer

A static document published on the corporate intranet.

Answer

A policy signed by all employees once every five years.

Question 9

How can an organization ensure privacy is considered during the vendor procurement phase?

Accepted Answer

Including privacy and data security requirements in the RFP.. Including privacy and data security requirements in the Request for Proposal (RFP) ensures that vendors are evaluated on their ability to meet the organization's privacy standards from the outset. This embeds privacy by design into procurement and allows for comparison of vendor capabilities before contract signing.

Answer

Hiring the vendor based solely on price.

Answer

Waiting until the contract is signed before asking for privacy details.

Answer

Allowing the vendor to provide their own privacy policy.

Question 10

What is the primary function of a privacy policy for external users?

Accepted Answer

To inform data subjects about the processing of their data.. A privacy policy is a transparency instrument that informs data subjects — customers, users, website visitors — about what personal data is collected, why it is processed, how long it is retained, with whom it is shared, and what rights they have. It fulfills the GDPR Articles 13–14 transparency obligations and CCPA/CPRA notice-at-collection requirements. Its primary function is therefore to inform data subjects about the processing of their data.

Answer

To prevent all data collection.

Answer

To list the names of all employees.

Answer

To act as a legal contract for system performance.

Question 11

Which of the following activities is essential for maintaining effective privacy governance over third-party processors?

Accepted Answer

Including mandatory privacy clauses in contracts and auditing compliance.. Effective privacy governance over third-party processors requires enforceable contractual obligations and ongoing verification that those obligations are met. Mandatory privacy clauses establish the legal basis for data protection requirements (purpose limitation, breach notification, sub-processor controls), while auditing compliance provides assurance that the processor actually adheres to them. Together they create accountability across the data processing lifecycle.

Answer

Only hiring large, well-known vendors.

Answer

Trusting the processor's own marketing brochures.

Answer

Giving the vendor full access to the corporate network.

Question 12

When implementing a privacy management system, what is the best approach to gain executive support?

Accepted Answer

Aligning privacy objectives with business value and risk management.. Executive support is most reliably obtained when privacy is framed in the language executives already use: business value, risk reduction, and strategic alignment. Aligning privacy objectives with business value and risk management demonstrates that privacy investment protects revenue, reduces regulatory exposure, and supports customer trust, which resonates with board-level priorities. This framing converts privacy from a perceived cost center into a governance enabler.

Answer

Asking for unlimited funding for software tools.

Answer

Sending a list of all regulatory articles.

Answer

Threatening the board with fines.

Question 13

Which role is primarily responsible for ensuring that privacy policies are communicated effectively across the organization?

Accepted Answer

The Privacy Office or DPO.. The Privacy Office or Data Protection Officer (DPO) owns the privacy program and is accountable for drafting, approving, and disseminating privacy policies to all workforce members and relevant stakeholders. This role translates regulatory requirements (GDPR, CCPA, HIPAA) into operational policy and ensures consistent communication through training, awareness campaigns, and acknowledgments. Communication effectiveness is a governance responsibility, not an IT or audit function.

Answer

The janitorial staff.

Answer

The external auditors.

Answer

The IT helpdesk.

Question 14

An organization is building a privacy program. What indicates that the privacy strategy is aligned with business operations?

Accepted Answer

Privacy controls are integrated into business workflows.. Alignment between privacy strategy and business operations is demonstrated when privacy controls are embedded into day-to-day workflows rather than bolted on as a separate compliance layer. This integration shows that privacy is operationalized across business processes, making it sustainable and effective. It reflects the principle of privacy by design and demonstrates cross-functional ownership.

Answer

The privacy team has their own budget.

Answer

The policy is saved on a shared drive.

Answer

The DPO reports to the CEO once a year.

Question 15

What is the first step in conducting a privacy audit?

Accepted Answer

Defining the scope and objectives of the audit.. The first step in any audit — privacy, security, or financial — is to define the scope and objectives, because this determines what will be examined, which controls and regulations apply, who the stakeholders are, and what success looks like. Without a defined scope, the auditor cannot select criteria, allocate resources, or produce findings that map to a standard such as GDPR, ISO 27701, or NIST Privacy Framework.

Answer

Asking employees for their lunch preferences.

Answer

Buying new security software.

Answer

Writing the final audit report.