CDPSE Privacy Governance Practice Test 3 — 15 Questions

Question 1

Which TWO of the following are key components of a robust privacy governance framework?

Accepted Answer

Clear assignment of roles and responsibilities.. Option A is correct because a robust privacy governance framework requires clearly defined roles and responsibilities—such as a Data Protection Officer, privacy stewards, and data owners—so accountability for handling personal data is unambiguous and enforceable. Option E is correct because documented privacy policies and procedures translate legal and regulatory requirements (e.g., GDPR, CCPA) into repeatable operational controls, covering data classification, retention, consent, breach response, and subject-access requests. The unmarked options do not belong: blocking all internet access (B) is an extreme, impractical network control rather than a governance component; the office floor plan (C) is a facilities artifact with no bearing on privacy accountability or process; and collecting employee social media passwords (D) is itself a privacy violation and a security risk, not a governance control.

Answer

A mandate to block all internet access.

Answer

The office floor plan.

Answer

A list of employee social media passwords.

Question 2

Which TWO of the following are common responsibilities of the privacy office?

Accepted Answer

Developing and delivering privacy training.. Option C is correct because the privacy office is responsible for developing and delivering privacy training to employees, ensuring they understand data protection policies, regulations, and best practices. Option D is correct because monitoring privacy compliance—through audits, assessments, and ongoing oversight—is a core function of the privacy office to ensure the organization adheres to privacy laws and internal policies. Option A is incorrect because setting annual sales targets is a sales or executive management responsibility, not a privacy function. Option B is incorrect because writing website code is a software development task, unrelated to privacy office duties. Option E is incorrect because repairing printers is an IT support or facilities task, not a privacy responsibility.

Answer

Setting the company's annual sales targets.

Answer

Writing code for the company website.

Answer

Repairing broken printers.

Question 3

When a company faces conflicting privacy regulations (e.g., GDPR vs. local laws), what is the most robust governance stance?

Accepted Answer

Apply the most stringent standard globally.. When privacy regulations conflict across jurisdictions, the most robust governance stance is to apply the most stringent standard globally. This harmonised approach ensures compliance everywhere the company operates, avoids fragmented controls, reduces legal risk, and simplifies audits — a principle endorsed by privacy frameworks and multinational compliance practice.

Answer

Apply the weakest regulation to reduce costs.

Answer

Ignore both and wait for the regulator to advise.

Answer

Only comply with the law of the country where the head office is located.

Question 4

Which TWO of the following should be considered when aligning privacy strategy with the business?

Accepted Answer

Primary business objectives and growth plans.. Option D is correct because a privacy strategy must be driven by the organization's primary business objectives and growth plans, ensuring that data protection controls enable rather than obstruct expansion into new markets, products, or data-intensive initiatives. Option E is correct because the organizational risk appetite defines how much privacy risk leadership is willing to accept, which directly shapes the stringency of privacy controls, investment levels, and prioritization of remediation efforts. Options A, B, and C are incorrect because a cafeteria menu, competitors' market share, and local weather forecasts have no bearing on how privacy strategy is aligned with business goals, risk tolerance, or regulatory obligations.

Answer

The local cafeteria menu.

Answer

The current market share of competitors.

Answer

The weather forecast in the corporate headquarters.

Question 5

Which THREE items should be included in a Privacy Impact Assessment (PIA) report?

Accepted Answer

Assessment of privacy risks to individuals.. A Privacy Impact Assessment (PIA) report must document the privacy risks that a system or process poses to individuals, so option C (Assessment of privacy risks to individuals) is correct because identifying and evaluating those risks is the core purpose of a PIA. Option D (Description of the personal data being processed) is correct because a PIA must specify what personal data is collected, how it is used, stored, shared, and retained, which is essential for assessing privacy impact. Option E (Proposed mitigation measures for identified risks) is correct because a PIA must recommend controls, such as data minimization, access restrictions, or encryption, to reduce the identified privacy risks. Option A (The cafeteria's weekly menu) is irrelevant to privacy risk analysis and has no bearing on personal data processing. Option B (The names of all employees in the marketing department) is not appropriate because a PIA describes categories of data subjects and data types rather than listing specific employees' names, which would itself create an unnecessary privacy exposure.

Answer

The cafeteria's weekly menu.

Answer

The names of all employees in the marketing department.

Question 6

Which THREE factors influence the maturity level of an organization's privacy governance?

Accepted Answer

The consistency of policy application across the enterprise.. Option B is correct because privacy governance maturity depends on how uniformly privacy policies, standards, and controls are applied across all business units, geographies, and functions; inconsistent application signals a lower maturity level, while enterprise-wide consistency indicates repeatable, defined processes. Option D is correct because embedding privacy requirements into automated processes (for example, privacy-by-design in SDLC, automated data subject request workflows, consent management platforms, and data classification tools) demonstrates higher maturity than relying on manual, ad hoc privacy handling. Option E is correct because continuous monitoring and reporting — such as ongoing control testing, privacy KPIs/KRIs, audit logging, and regular reporting to management — reflect the measured and managed stages of a maturity model rather than an initial, reactive state. Option A is not relevant because the amount of rented office space has no bearing on privacy governance capability or process maturity. Option C is not relevant because the headcount of the IT department alone does not indicate how well privacy is governed, integrated, or monitored.

Answer

The amount of office space rented.

Answer

The number of employees in the IT department.

Question 7

Which THREE of the following are essential elements of a privacy governance framework?

Accepted Answer

Continuous monitoring and auditing of privacy controls.. Option A (Continuous monitoring and auditing of privacy controls) is essential because a privacy governance framework must verify that controls remain effective over time, using ongoing assessments, audits, and metrics to detect gaps and drive remediation. Option B (Clear privacy roles and responsibilities) is essential because governance requires defined accountability — such as a Data Protection Officer, privacy stewards, and data owners — so that decisions, escalations, and compliance tasks have named owners. Option D (Comprehensive privacy policies) is essential because written policies codify the organization's privacy principles, legal obligations, and acceptable data-handling practices, providing the baseline against which controls and roles operate. Options C (a collection of all company invoices) and E (a list of employee salaries) are not governance elements; invoices and salary data are business or HR records that may contain personal data but do not themselves establish privacy governance structures, accountability, or oversight.

Answer

A collection of all company invoices.

Answer

A list of employee salaries.

Question 8

Which THREE of the following are benefits of a centralized privacy governance model?

Accepted Answer

Simplified communication of privacy standards to all regions.. Option B is correct because a centralized privacy governance model establishes a single authoritative source for privacy standards, which makes it far simpler to communicate those standards uniformly to every region rather than reconciling multiple decentralized messages. Option C is correct because centralization consolidates privacy data, metrics, and accountability into one function, enabling senior management to perform oversight and generate reports more easily and reliably. Option E is correct because a single governing body creates and enforces one set of policies, yielding consistent application of privacy requirements across the entire entity. Option A is incorrect because centralization typically reduces, not increases, costs by eliminating duplicate efforts. Option D is incorrect because no governance model permits ignoring local laws; a centralized model must still accommodate regional legal requirements.

Answer

Higher costs due to duplicate efforts.

Answer

The ability to ignore local laws.

Question 9

A CDPSE practitioner is tasked with aligning the organization's privacy strategy with business goals. Which of the following activities should be prioritized to ensure that privacy governance is embedded within the Software Development Life Cycle (SDLC)?

Accepted Answer

Conduct a Privacy Impact Assessment (PIA) during the initial requirements gathering phase.. Embedding privacy governance in the SDLC requires action at the earliest phase — requirements gathering — where a Privacy Impact Assessment (PIA) identifies privacy risks, legal obligations, and design constraints before any development begins. Conducting the PIA during requirements ensures privacy requirements are translated into functional and non-functional specifications, making privacy a built-in property rather than a post-hoc check. This aligns with privacy-by-design and GDPR Article 25 obligations.

Answer

Review the privacy policy after the product has been moved to general availability.

Answer

Perform a penetration test on the production environment after the release deployment.

Answer

Automate data deletion scripts after the data retention period has expired.

Question 10

An organization is updating its privacy governance framework to comply with GDPR. The Data Protection Officer (DPO) needs to ensure that the accountability principle is met. Which of the following actions best demonstrates accountability?

Accepted Answer

Establishing a centralized Record of Processing Activities (ROPA).. The GDPR accountability principle (Article 5(2)) requires the controller to demonstrate compliance, not just comply. A centralized Record of Processing Activities (ROPA) under Article 30 is the foundational artifact that documents what data is processed, why, by whom, where, and with what safeguards, and it is the primary evidence a DPO can produce to show accountability. It operationalizes the principle by making processing transparent and auditable.

Answer

Outsourcing all data processing activities to a third-party vendor.

Answer

Implementing a strong password policy for all employees.

Answer

Creating a public-facing website privacy notice.

Question 11

Which role is primarily responsible for the overall oversight of privacy governance within an organization to ensure that privacy policies are being followed?

Accepted Answer

Data Protection Officer (DPO). The Data Protection Officer (DPO) is the role charged with monitoring compliance with privacy laws and internal policies, advising on data protection obligations, and acting as the point of contact for regulators and data subjects. This oversight mandate — independent of operational IT or finance functions — makes the DPO primarily responsible for ensuring privacy policies are followed. Option C reflects that statutory and governance role.

Answer

Chief Financial Officer (CFO)

Answer

Chief Information Officer (CIO)

Answer

External Legal Counsel

Question 12

A multinational organization is struggling to maintain consistent privacy practices across different jurisdictions. Which approach is most effective for centralizing privacy governance while allowing for local legal variations?

Accepted Answer

Adopt a 'hub and spoke' privacy governance model.. A 'hub and spoke' privacy governance model centralizes policy-setting, standards, and oversight at the corporate hub while allowing local spokes to adapt implementation to jurisdictional legal variations. This balances global consistency with local compliance, ensuring that regional requirements (e.g., GDPR, CCPA, PIPL) are met without fragmenting the overall governance framework. It is the recommended approach for multinationals facing divergent privacy laws.

Answer

Standardize all data processing to occur only in the home country.

Answer

Allow each region to define its own privacy framework independently.

Answer

Enforce a single, global privacy policy that overrides all local laws.

Question 13

During an audit, it is discovered that privacy policies have not been updated for three years, despite significant changes in business data collection practices. Which governance failure is most evident?

Accepted Answer

Lack of a formal policy review and approval lifecycle.. Privacy policies that remain unchanged for three years while data collection practices evolve indicate that no one owns or triggers a periodic review and approval cycle. A formal policy review and approval lifecycle would have mandated scheduled reviews, version control, and sign-off when business practices changed. This is a governance failure in the policy management process itself, not a resourcing or training issue.

Answer

Insufficient budget for the privacy office.

Answer

Inadequate training for staff on data privacy.

Answer

Failure of the IT department to implement technical controls.

Question 14

Which tool is best suited for establishing the scope of a privacy governance program by identifying where personal data resides across the organization?

Accepted Answer

Data Inventory / Data Map. A data inventory or data map identifies what personal data exists, where it resides, how it flows, and who owns it across systems and jurisdictions—this is the foundational artifact for scoping a privacy governance program. Without knowing where personal data lives, an organization cannot define program boundaries, apply controls, or meet regulatory requirements like records of processing. It directly answers the scoping question.

Answer

Access Control Matrix

Answer

Privacy Impact Assessment (PIA)

Answer

Incident Response Plan

Question 15

When evaluating a third-party vendor's privacy maturity, which document is most critical for the privacy practitioner to review during the due diligence process?

Accepted Answer

A SOC 2 Type II report or independent privacy audit report.. A SOC 2 Type II report or independent privacy audit report is the most critical document because it provides an independent assessment of the vendor's controls over a period of time, including privacy and security practices. This gives the privacy practitioner evidence of the vendor's privacy maturity and compliance. Stock performance, marketing brochures, and org charts do not provide assurance about privacy controls.

Answer

The vendor's public stock market performance.

Answer

The vendor's marketing brochure.

Answer

The vendor's internal organizational chart.