CDPSE Privacy Governance Practice Test 5 — 15 Questions

Question 1

A privacy program manager at a mid-sized healthcare technology company is drafting the organization's first privacy governance charter. The CEO wants the program to be structured so that a single executive has clear authority and accountability for privacy across all business units, but also wants input from department heads to ensure alignment. Which governance structure best meets these requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A centralized model led by a Chief Privacy Officer (CPO) who reports to the CEO, supported by a privacy steering committee composed of department heads.. The CEO requires both a single accountable executive and cross-functional input. A centralized structure led by a CPO who reports to the CEO establishes clear authority and accountability, while a privacy steering committee of department heads provides the collaborative input needed for business alignment. This combination satisfies both governance requirements and reflects established privacy governance practice.

Answer

A federated model where privacy responsibilities are split between the legal department and IT, with no single executive owner.

Answer

A decentralized model where each business unit appoints its own privacy lead who reports to the unit's general manager.

Answer

An outsourced model where an external consulting firm manages the privacy program and reports directly to the board of directors.

Question 2

A financial services company is implementing a new privacy governance framework. The Chief Privacy Officer wants to ensure that privacy risks are identified and addressed at the earliest stages of any new project. Which of the following approaches BEST integrates privacy into project management?

Accepted Answer

Embedding privacy requirements into the system development life cycle (SDLC). Embedding privacy into the SDLC is the most effective way to integrate privacy into project management because it makes privacy a continuous, structured component of every project phase. This ensures early risk identification and mitigation, whereas training, champions, or a single pre-initiation assessment are less systematic and may not address evolving risks.

Answer

Appointing a privacy champion in each business unit

Answer

Requiring a privacy impact assessment (PIA) before project initiation

Answer

Conducting annual privacy training for all project managers

Question 3

A financial services company is revising its privacy governance framework to better integrate privacy risk management with its enterprise risk management (ERM) program. The Chief Privacy Officer wants to ensure that privacy risks are consistently identified, assessed, and treated in alignment with other organizational risks. Which of the following is the MOST critical action to achieve this integration?

Accepted Answer

Adopt the enterprise risk management framework's risk assessment methodology and scales for privacy risk assessments. Using the ERM framework's risk assessment methodology and scales for privacy risks is critical because it enables consistent evaluation, prioritization, and treatment of privacy risks alongside other organizational risks. This alignment supports integrated risk reporting and decision-making, ensuring that privacy risks receive appropriate attention and resources within the broader risk management context.

Answer

Assign all privacy risk management responsibilities to the internal audit department

Answer

Develop a separate privacy risk register that is maintained independently from the ERM risk register

Answer

Conduct annual privacy risk assessments separately from the ERM risk assessment cycle

Question 4

A global financial services firm is subject to GDPR and is establishing a privacy governance structure. The board wants to ensure that privacy risks are reported at the highest level. Which reporting structure best achieves this while maintaining operational independence for the privacy office?

Accepted Answer

The Chief Privacy Officer reports directly to the board of directors or a board-level risk committee.. For a global financial services firm subject to GDPR, the privacy office must have independence and direct access to the board. Reporting to a board-level committee ensures that privacy risks are considered at the highest level and that the privacy office can operate without conflicts of interest. This structure supports compliance and effective governance.

Answer

The Chief Privacy Officer reports to the Chief Marketing Officer (CMO).

Answer

The Chief Privacy Officer reports to the Chief Financial Officer (CFO).

Answer

The Chief Privacy Officer reports to the Chief Information Security Officer (CISO).

Question 5

A small e-commerce company is creating its first privacy program. The CEO wants to ensure that privacy requirements are considered in all new projects from the start. Which governance mechanism is MOST appropriate to embed privacy by design?

Accepted Answer

Require a privacy impact assessment for every new project that involves personal data.. A privacy impact assessment is the most appropriate mechanism because it is a proactive, project-specific process that identifies and addresses privacy risks at the design stage. This aligns with the principle of privacy by design and ensures that privacy is built into systems and processes from the outset.

Answer

Conduct an annual privacy training session for all employees.

Answer

Appoint a privacy officer to review all projects after they are launched.

Answer

Include a privacy clause in all vendor contracts.

Question 6

A multinational retailer's privacy program is governed by a central team, but regional marketing teams frequently launch campaigns using local tools that collect personal data. These campaigns often bypass privacy review. The Chief Privacy Officer wants to embed accountability without creating a bottleneck. Which action best addresses this governance gap?

Accepted Answer

Implement a privacy-by-design checklist and automated approval workflow that regional teams must complete before launching campaigns.. Embedding privacy accountability requires distributing responsibility to business units while maintaining central oversight. A privacy-by-design checklist and automated approval workflow enable regional teams to self-assess and document compliance, reducing reliance on central review. This approach scales, provides auditability, and fosters a culture of privacy without creating bottlenecks. It directly addresses the gap where campaigns bypass privacy review by making the process a mandatory step in campaign launch.

Answer

Prohibit regional marketing teams from using any tools not approved by the central privacy team.

Answer

Require all marketing campaigns to be submitted to the central privacy team for manual review before launch.

Answer

Assign a dedicated privacy liaison to each regional marketing team who reports only to the regional marketing director.

Question 7

A global retailer has a privacy program that is managed regionally, leading to inconsistent data subject request (DSR) handling times and conflicting interpretations of consent requirements. The Chief Privacy Officer wants to improve consistency while allowing regions to adapt to local laws. Which governance approach BEST balances these needs?

Accepted Answer

Adopt a federated model with a central privacy office setting minimum standards and regional privacy leads responsible for local implementation. A federated privacy governance model establishes central standards and oversight while empowering regional teams to implement locally appropriate practices. This balances the need for consistent DSR handling and consent interpretation with the flexibility to comply with diverse legal requirements. Centralized or fully decentralized models fail to achieve this balance, and outsourcing does not inherently provide the needed regional adaptability.

Answer

Implement a centralized privacy operating model where all DSRs and consent decisions are made by the global privacy team

Answer

Outsource all privacy operations to a third-party service provider with global reach

Answer

Allow each region to continue managing privacy independently but require them to report metrics to the global privacy team

Question 8

A global retailer is expanding into new markets and must align its privacy program with multiple regulatory regimes, including the GDPR and the CCPA. The Chief Privacy Officer wants to ensure the program can adapt to future regulatory changes without requiring a complete redesign each time. Which approach best supports this goal?

Accepted Answer

Implement a principles-based privacy framework that maps controls to multiple regulatory requirements and is reviewed periodically.. A principles-based framework provides a stable foundation of privacy principles and maps controls to multiple regulations. When new laws emerge, the organization can update mappings and controls rather than rebuild the program. This scalability and adaptability are essential for a global retailer facing evolving regulatory landscapes, making it the most effective approach for the CPO's goal.

Answer

Delegate privacy compliance to regional legal teams, allowing each to interpret and implement requirements independently.

Answer

Rely on the strictest regulation among all operating jurisdictions and apply its requirements uniformly worldwide.

Answer

Adopt a jurisdiction-specific compliance playbook that is updated whenever a new regulation is enacted.

Question 9

A healthcare organization is establishing a privacy governance program. The Chief Privacy Officer is defining the roles and responsibilities of the privacy office. Which TWO of the following are core responsibilities of the privacy office? (Choose two.)

Accepted Answer

Conducting privacy training and awareness programs. The privacy office is fundamentally responsible for developing policies and standards and for delivering training and awareness. These functions establish the governance framework and equip employees to comply. Managing IT infrastructure, budgeting, and contract negotiation are outside the privacy office's core scope, although collaboration with those functions is important.

Answer

Negotiating contracts with third-party processors

Answer

Managing the organization's IT security infrastructure

Answer

Approving the annual marketing budget

Question 10

An organization's privacy governance policy states that privacy impact assessments (PIAs) must be conducted for all new projects involving personal data. A project manager is launching a new customer loyalty program that will collect and process personal data. Which of the following should the project manager do FIRST to comply with the policy?

Accepted Answer

Conduct a privacy impact assessment (PIA) before proceeding with the project. The privacy governance policy mandates a PIA for all new projects involving personal data. The project manager should conduct the PIA first to identify and address privacy risks early in the project lifecycle. This proactive approach ensures compliance with the policy and helps avoid costly redesigns or regulatory issues later.

Answer

Implement the program and then conduct a PIA if customer complaints arise

Answer

Ask the IT department to perform a security assessment instead of a PIA

Answer

Consult with the legal department to determine if the program requires a PIA

Question 11

A multinational corporation's privacy team is struggling to keep pace with new privacy laws across 20 countries. The chief privacy officer wants to shift from a reactive to a proactive governance model. Which initiative would BEST enable this transformation?

Accepted Answer

Implement a privacy management platform that tracks regulatory changes and automates assessments.. Implementing a privacy management platform best enables a proactive governance model by automating regulatory tracking, assessments, and reporting across multiple jurisdictions. It provides scalability and real-time visibility, allowing the privacy team to anticipate and respond to changes efficiently, rather than reacting after the fact.

Answer

Conduct an annual global privacy audit to identify gaps after laws take effect.

Answer

Hire additional privacy lawyers in each country to monitor legislative changes.

Answer

Delegate privacy compliance to local business units without central oversight.

Question 12

A technology company is expanding into new markets and needs to ensure its privacy governance program can scale. The privacy team is small and must prioritize activities. Which activity should be the first step in establishing governance for the new markets?

Accepted Answer

Conduct a data inventory and mapping exercise for the new markets to understand what personal data is collected and how it flows.. A data inventory and mapping exercise is the foundation of privacy governance. It provides the necessary understanding of data processing activities to develop policies, assign roles, and select tools. Without it, other activities are based on incomplete information. Therefore, it should be the first step when scaling governance to new markets.

Answer

Appoint a privacy lead in each new market before understanding the data landscape.

Answer

Implement a new privacy technology tool to automate compliance across all markets.

Answer

Draft new privacy policies for each new market based on assumptions about local laws.

Question 13

A healthcare organization's privacy office is revising its governance charter. The Chief Privacy Officer wants to ensure that the privacy program has the authority to influence decisions about new health data analytics initiatives. Which change to the governance structure would most directly enable this?

Accepted Answer

Establish a privacy steering committee that includes the Chief Privacy Officer and reports to the board of directors.. To influence decisions, the privacy program needs formal authority and a seat at the strategic table. A privacy steering committee that reports to the board provides that authority and ensures privacy is considered in high-level initiatives like health data analytics. It also facilitates escalation and resource allocation. Other options improve operations or awareness but do not change governance authority. Thus, the steering committee structure is the most direct enabler.

Answer

Increase the privacy team's budget to hire more analysts for handling data subject access requests.

Answer

Delegate privacy decision-making to the analytics department to speed up project approvals.

Answer

Require the privacy team to conduct annual privacy training for all analytics staff.

Question 14

A privacy steering committee is being established to oversee a company's privacy program. The committee must ensure that privacy risks are effectively managed across the organization. Which TWO of the following are the MOST important responsibilities of this committee? (Choose two.)

Accepted Answer

Reviewing and resolving escalated privacy issues and conflicts. The privacy steering committee is a governance body responsible for strategic direction, resource allocation, and resolving escalated privacy issues. It does not engage in operational tasks like daily monitoring, training material development, or technical assessments. By focusing on these high-level responsibilities, the committee ensures that privacy risks are managed consistently and that the program has the necessary support and authority.

Answer

Conducting daily monitoring of privacy compliance activities

Answer

Developing detailed privacy training materials for employees

Answer

Performing technical vulnerability assessments on privacy systems

Question 15

A privacy analyst is reviewing the organization's privacy governance documentation and notices that the roles and responsibilities for privacy are not clearly defined. According to generally accepted privacy governance principles, what is the most appropriate first step to address this gap?

Accepted Answer

Draft a privacy charter that assigns accountability to specific roles and obtains executive approval.. The analyst identified a lack of clearly defined privacy roles and responsibilities. The foundational step is to create a privacy charter that assigns accountability to specific roles and secures executive approval. This establishes the governance structure necessary for other activities like assessments, technology implementation, and training to be effective and properly directed.

Answer

Conduct a privacy impact assessment for all business processes.

Answer

Implement a new privacy technology solution to automate compliance monitoring.

Answer

Schedule privacy awareness training for all employees.