CDPSE Privacy Governance Practice Test 4 — 15 Questions

Question 1

Which THREE of the following are essential components of an effective privacy governance framework?

Accepted Answer

Clear privacy policies and standards.. An effective privacy governance framework requires clear privacy policies and standards (A) because they establish the binding rules, principles, and data-handling requirements that translate legal and regulatory obligations into operational direction for the organization. Defined privacy roles and responsibilities (B) are essential because governance depends on explicit accountability — such as assigning a Data Protection Officer, privacy stewards, and data owners — so that decision rights and duties are unambiguous. A formal mechanism for monitoring and auditing compliance (D) is also essential, since it provides ongoing assurance through audits, control testing, and metrics that verify policies are actually followed and enable corrective action. Options C and E do not belong: a list of IT hardware serial numbers is an asset-management detail, not a governance component, and annual tax filing documentation is a financial/tax artifact unrelated to privacy governance.

Answer

A list of all IT hardware serial numbers.

Answer

The organization's annual tax filing documentation.

Question 2

Which TWO of the following should be considered when aligning privacy strategy with broader business objectives?

Accepted Answer

The organization's stated risk appetite.. Option B is correct because the organization's stated risk appetite defines how much privacy risk leadership is willing to accept, and the privacy strategy must be calibrated to that tolerance so that data-protection controls, investments, and residual-risk decisions stay consistent with broader business goals. Option C is correct because applicable legal and regulatory requirements (for example GDPR, CCPA/CPRA, HIPAA, or sector-specific rules) set mandatory privacy obligations that the strategy must satisfy, and aligning them with business objectives ensures compliance is built into operations rather than treated as an afterthought. The remaining options do not belong: A (email font) is a cosmetic branding detail with no bearing on privacy risk or compliance, D (number of employees using public transit) is an irrelevant commuting statistic, and E (breakroom location) is a facilities matter unrelated to privacy strategy or business objectives.

Answer

The specific font used in corporate emails.

Answer

The number of employees who take public transit.

Answer

The physical location of the office breakroom.

Question 3

Which TWO of the following are primary benefits of establishing a mature privacy governance program?

Accepted Answer

Enhanced consumer trust and brand reputation.. Option A is correct because a mature privacy governance program demonstrates accountability and transparency in handling personal data, which directly strengthens consumer trust and enhances brand reputation. Option D is correct because such a program aligns organizational practices with privacy laws and regulations (e.g., GDPR, CCPA), thereby reducing the likelihood and severity of regulatory fines and legal penalties. Option B is not correct because revenue increases are not an automatic or guaranteed outcome of privacy governance; they depend on many business factors. Option C is not correct because privacy governance complements, rather than replaces, the IT department's operational and security responsibilities. Option E is not correct because no governance program can guarantee that data breaches will never occur; it can only reduce risk and improve response readiness.

Answer

Automatic increase in quarterly revenue.

Answer

Elimination of the need for an IT department.

Answer

Guarantee that no data breaches will ever occur.

Question 4

A global retail company is developing a privacy governance framework. The Chief Privacy Officer wants to ensure that privacy requirements are embedded into business processes rather than treated as a standalone compliance activity. Which of the following is the MOST effective approach to achieve this integration?

Accepted Answer

Implement privacy by design principles into the system development lifecycle and business process management.. Embedding privacy by design into the system development lifecycle and business process management ensures that privacy controls are built into operations from the start. This proactive approach makes privacy a default consideration, reducing the need for retroactive fixes and aligning with the objective of integrating privacy into business processes.

Answer

Conduct annual privacy awareness training for all employees.

Answer

Require each department to appoint a privacy champion who reports to the CPO.

Answer

Establish a privacy steering committee that reviews and approves all business process changes.

Question 5

A US-based retailer with e-commerce operations in the EU and California wants to establish a unified privacy governance structure. The Chief Privacy Officer must decide how to allocate decision-making authority for privacy policies across the organization. Which approach best balances global consistency with local legal compliance?

Accepted Answer

A hybrid governance model where the Chief Privacy Officer establishes global privacy principles and a central team coordinates, while regional privacy leads adapt policies to local laws within those principles.. A hybrid governance model allows the organization to maintain a consistent global privacy framework while respecting local legal requirements. The central team sets principles and coordinates, and regional leads adapt policies to specific laws. This approach ensures both compliance and operational efficiency, making it the most effective for a multinational retailer facing diverse regulations.

Answer

A federated model where each regional privacy lead has full autonomy to set policies for their jurisdiction, with no central oversight.

Answer

An outsourced model where an external law firm is given full authority to create and enforce privacy policies across all jurisdictions.

Answer

A centralized model where the Chief Privacy Officer sets all policies globally, with regional leads responsible only for implementation.

Question 6

A global retailer's privacy office discovers that its EU subsidiary is using a marketing analytics tool that transfers customer IP addresses to a cloud provider in a country without an adequacy decision. The subsidiary's local management insists the tool is essential for campaign performance. As the privacy lead, what should you do FIRST to address this governance gap?

Accepted Answer

Conduct a transfer impact assessment to evaluate the legal and privacy risks of the data transfer.. The correct first action is to assess the risk through a transfer impact assessment, which identifies the legal landscape of the destination country and evaluates the effectiveness of any safeguards. This assessment informs whether the transfer can continue with additional measures or must be restructured. It is a foundational governance step before remediation or escalation.

Answer

Allow the transfer to continue while updating the privacy notice to disclose the practice.

Answer

Report the subsidiary to the local data protection authority for non-compliance.

Answer

Instruct the subsidiary to immediately terminate the vendor contract and cease all data transfers.

Question 7

A healthcare organization is establishing a privacy governance program. The board of directors wants to ensure that privacy risks are managed at the highest level. Which of the following is the PRIMARY responsibility of the board in privacy governance?

Accepted Answer

Reviewing and approving the privacy strategy and risk appetite.. The board's primary governance role is to provide strategic direction and oversight, which includes approving the privacy strategy and defining risk appetite. This sets the foundation for the entire privacy program and ensures that privacy is considered at the highest levels of decision-making.

Answer

Developing privacy training materials for employees.

Answer

Managing data subject access requests.

Answer

Conducting privacy impact assessments for new projects.

Question 8

A privacy manager at a rapidly growing healthcare technology company is designing the organization's privacy governance structure. The company has a small privacy team and wants to ensure that privacy decisions are made quickly and consistently across all business units. Which of the following governance models would BEST achieve this goal?

Accepted Answer

A centralized model where a single privacy office, led by a Chief Privacy Officer, has authority over privacy decisions across all units. A centralized privacy governance model is most effective for a growing organization with a small privacy team because it enables quick, consistent decisions and efficient use of limited resources. By vesting authority in a single privacy office, the organization ensures that privacy requirements are applied uniformly across all business units, reducing the risk of conflicting practices and compliance gaps.

Answer

A federated model where each business unit manages privacy independently but shares best practices through a voluntary community of practice

Answer

A decentralized model where each business unit has its own privacy lead who reports to the unit head

Answer

An outsourced model where an external law firm provides all privacy guidance and decision-making

Question 9

A financial services company is expanding into a new jurisdiction that has no comprehensive data protection law but has sector-specific privacy rules for financial data. The chief privacy officer must decide how to govern privacy for the new market. Which approach BEST aligns with the organization's existing global privacy framework?

Accepted Answer

Conduct a gap analysis between local sector rules and the global policy, then integrate necessary controls.. A gap analysis is the most effective way to reconcile local sector-specific privacy rules with a global framework. It identifies discrepancies and allows for the integration of additional controls without abandoning the overarching privacy principles. This approach ensures legal compliance while maintaining operational consistency and scalability.

Answer

Apply the organization's global privacy policy uniformly, ignoring local sector-specific rules.

Answer

Develop a localized privacy policy that meets the sector-specific rules but diverges from global standards.

Answer

Delay market entry until the jurisdiction enacts a comprehensive data protection law.

Question 10

A privacy program manager is updating the organization's privacy governance charter to reflect new regulatory requirements. The charter must define the authority and responsibilities of the privacy office. Which two of the following are essential to include in the charter to ensure the privacy office can effectively enforce compliance? (Choose two.)

Accepted Answer

The privacy office has the authority to approve or reject new data processing activities that pose unacceptable privacy risks.. A governance charter must grant the privacy office both preventive authority (approving or rejecting risky processing) and corrective authority (imposing sanctions). These powers enable the privacy office to enforce compliance effectively and ensure privacy is integrated into business processes. Without them, the privacy office cannot fulfill its oversight role.

Answer

The privacy office is responsible for negotiating all contracts with third-party data processors.

Answer

The privacy office reports directly to the Chief Financial Officer to ensure budget alignment.

Answer

The privacy office must obtain approval from the marketing department before updating privacy policies.

Question 11

A global retailer is expanding into new markets and needs a holistic view of how personal data moves across its subsidiaries and third parties. The Chief Privacy Officer wants a single, visual representation that maps data flows, identifies cross-border transfers, and highlights potential risk points. Which privacy governance tool should be used to achieve this?

Accepted Answer

Data flow mapping. Data flow mapping is the only tool that provides a visual, end-to-end view of personal data movement, which is essential for understanding cross-border transfers and identifying risk points. The other options are important privacy governance instruments, but they do not deliver the holistic, visual representation required for this scenario.

Answer

Data protection impact assessment (DPIA)

Answer

Privacy maturity assessment

Answer

Record of processing activities (ROPA)

Question 12

A multinational retail corporation is updating its privacy governance framework to address new data protection regulations in multiple jurisdictions. The Chief Privacy Officer wants to ensure that the framework includes mechanisms for ongoing compliance monitoring and continuous improvement. Which of the following should be implemented FIRST to establish a foundation for effective monitoring?

Accepted Answer

Conduct a comprehensive data inventory and mapping exercise to identify all personal data flows. A comprehensive data inventory and mapping exercise is the essential first step because it provides the necessary visibility into personal data processing activities. This visibility enables the organization to identify compliance gaps, prioritize monitoring efforts, and implement effective controls. Without it, subsequent monitoring tools and governance structures lack the data they need to function effectively.

Answer

Establish a privacy steering committee to oversee compliance monitoring efforts

Answer

Implement a training program for all employees on privacy compliance requirements

Answer

Deploy a privacy management software platform to automate compliance tracking

Question 13

A healthcare organization is establishing a privacy governance framework. The Chief Privacy Officer wants to ensure that privacy policies are consistently applied across all departments. Which mechanism is most effective for achieving this consistency?

Accepted Answer

Implement a centralized privacy policy repository with mandatory training and periodic audits.. A centralized repository combined with training and audits ensures that all departments adhere to the same privacy policies. This approach provides clear guidance, reinforces expectations, and enables ongoing monitoring. It is the most effective way to achieve consistent application of privacy policies across a healthcare organization.

Answer

Delegate policy enforcement to department heads without central monitoring.

Answer

Allow each department to develop its own privacy policies based on its specific needs.

Answer

Rely on the legal department to review departmental policies only when a complaint is filed.

Question 14

A healthcare organization is revising its privacy governance structure after a series of data incidents involving unauthorized access by employees. The board wants to ensure accountability and reduce future risks. Which TWO of the following actions should be prioritized to strengthen governance? (Choose two.)

Accepted Answer

Establish a privacy steering committee that includes senior leaders from legal, IT, and clinical operations.. Mandatory role-based training and a cross-functional steering committee directly address the governance gaps that led to unauthorized access. Training reduces human error and builds awareness, while the committee ensures accountability and strategic oversight. Together, they create a stronger privacy culture and structure.

Answer

Increase the number of privacy impact assessments conducted annually.

Answer

Publish a revised privacy notice on the organization's website.

Answer

Delegate all privacy decision-making to the IT security department.

Question 15

A privacy manager is drafting the charter for a new privacy program. The organization operates in multiple countries and wants to ensure the program has clear authority and accountability. Which of the following should be the PRIMARY element to establish in the charter to enable effective governance?

Accepted Answer

A statement of the privacy program's mandate, scope, and reporting lines to executive leadership. A privacy program charter must establish the program's mandate, scope, and reporting lines to executive leadership. This creates the authority and accountability necessary for the program to function effectively across multiple jurisdictions. Other elements like data inventories, training, and audits are important but are operational or assurance activities that depend on a strong governance foundation.

Answer

A schedule for periodic privacy audits and assessments

Answer

A comprehensive training plan for all employees on privacy principles

Answer

A detailed list of all personal data processing activities across the organization