CDPSE Privacy Governance — Timed 15 Questions

Question 1

In the context of the NIST Privacy Framework, what is the primary role of the 'Govern' (GV) function?

Accepted Answer

Communicating privacy risks to stakeholders.. In the NIST Privacy Framework, the Govern (GV) function establishes and communicates the organization's privacy risk management strategy, including roles, responsibilities, and how privacy risk is communicated to stakeholders. It is the foundational function that sets policy and ensures accountability across the other functions (Identify, Control, Communicate, Protect). Communicating privacy risks to stakeholders is therefore a core GV activity.

Answer

Creating data erasure requests.

Answer

Detecting privacy breaches.

Answer

Implementing technical access controls.

Answer

Archiving personal data.

Question 2

When designing a privacy incident response plan, who should be the primary decision-maker for reporting a breach to a regulator?

Accepted Answer

The Data Protection Officer (DPO).. The Data Protection Officer (DPO) is the role charged with advising on and monitoring compliance with data protection law, including assessing whether a breach triggers regulatory notification obligations. The DPO typically leads the decision framework for reporting, coordinating with legal and executive leadership, because they hold the specialized knowledge of notification thresholds and timelines. This makes the DPO the primary decision-maker for regulator reporting.

Answer

The software vendor.

Answer

The office administrator.

Answer

The social media manager.

Question 3

Which TWO of the following are effective ways to measure the success of a privacy program?

Accepted Answer

Reduction in the number of privacy-related incidents.. Option A is correct because a reduction in the number of privacy-related incidents is a direct, quantifiable outcome metric that demonstrates the privacy program is preventing data breaches, unauthorized disclosures, and policy violations, showing measurable risk reduction over time. Option B is correct because successful completion of internal and external privacy audits verifies that the program's controls, policies, and procedures conform to frameworks such as GDPR, HIPAA, or ISO/IEC 27701, providing independent assurance of compliance and operational effectiveness. Options C, D, and E are incorrect because the color of office walls, the number of coffee machines, and the number of office chairs purchased are unrelated to privacy controls, data protection outcomes, or regulatory compliance, and therefore cannot serve as valid success measures for a privacy program.

Answer

The color of the office walls.

Answer

The number of coffee machines in the breakroom.

Answer

How many office chairs are purchased.

Question 4

A multinational financial services firm is updating its privacy governance program to address increasing regulatory scrutiny. The Chief Privacy Officer must ensure that the program includes mechanisms for accountability and enforcement. Which TWO of the following are essential components for achieving this? (Choose two.)

Accepted Answer

A privacy incident response plan that includes disciplinary actions for violations.. Defined roles and responsibilities establish who is accountable for privacy, while an incident response plan with disciplinary actions provides enforcement. Together, they create a governance structure where privacy obligations are clearly owned and violations have consequences, ensuring the program can be effectively enforced.

Answer

A privacy budget allocated to the marketing department.

Answer

Annual privacy training for all employees.

Answer

Regular privacy awareness campaigns for customers.

Question 5

A global technology company is establishing a privacy governance program to comply with multiple privacy regulations across different regions. The Chief Privacy Officer is identifying key roles and responsibilities to ensure clear accountability and effective oversight. Which TWO of the following are essential roles that should be defined within the privacy governance program? (Choose two.)

Accepted Answer

A Privacy Steering Committee composed of cross-functional executives to provide strategic direction and oversight. The DPO and the Privacy Steering Committee are essential roles in a privacy governance program. The DPO ensures regulatory compliance and acts as a liaison with authorities, while the steering committee provides strategic oversight and cross-functional alignment. Together, they establish clear accountability and direction for the privacy program, which is vital for managing complex, multi-jurisdictional privacy requirements.

Answer

A Data Steward responsible for the day-to-day management of data quality and metadata

Answer

A Privacy Program Manager responsible for implementing privacy policies and managing privacy operations

Answer

A Chief Information Security Officer (CISO) responsible for implementing technical security controls to protect personal data

Question 6

Which governance structure is most appropriate for a decentralized organization managing privacy risks?

Accepted Answer

Hub-and-spoke model with localized privacy champions.. A hub-and-spoke model with localized privacy champions is most appropriate for a decentralized organization because it balances central oversight (hub) with local implementation (spokes). This structure ensures consistent privacy policies while allowing flexibility for regional differences and fostering accountability at the local level.

Answer

Ad-hoc committee based on project needs.

Answer

Outsourcing all privacy functions.

Answer

Centralized command-and-control structure.

Question 7

Which document should a CDPSE practitioner review first when establishing a new privacy governance program?

Accepted Answer

The existing business strategy and risk appetite.. A privacy governance program must be aligned with the organization's strategic direction and risk tolerance, so the first document to review is the existing business strategy and risk appetite. This establishes why the program exists, what business outcomes it must support, and how much privacy risk leadership is willing to accept. Without that context, a practitioner cannot prioritize regulatory obligations, allocate resources, or define meaningful metrics.

Answer

The list of current vendors.

Answer

The software inventory.

Answer

The technical architecture diagram.

Question 8

A company is moving to a cloud-based SaaS environment. Who retains the primary responsibility for privacy governance?

Accepted Answer

The Data Controller (the company).. In a cloud-based SaaS environment, the Data Controller (the company) retains primary responsibility for privacy governance. Under GDPR, the controller determines the purposes and means of processing personal data and is accountable for compliance, even when using a Cloud Service Provider (CSP) as a processor. The CSP acts on behalf of the controller and provides technical safeguards, but the ultimate responsibility remains with the controller.

Answer

The individual data subjects.

Answer

The Lead Supervisory Authority.

Answer

The Network Infrastructure team.

Answer

The Cloud Service Provider (CSP).

Question 9

When aligning privacy strategy with business objectives, what is the primary metric to demonstrate the value of a privacy program to stakeholders?

Accepted Answer

Reduction in privacy-related regulatory non-compliance fines.. Reduction in privacy-related regulatory non-compliance fines is the primary metric that demonstrates the value of a privacy program to stakeholders because it directly ties privacy efforts to financial risk mitigation and business outcomes. Stakeholders care about avoided costs and regulatory penalties, making this a quantifiable business value metric. Training sessions, tool spend, and patch counts are activity metrics, not outcome metrics.

Answer

Count of privacy training sessions completed.

Answer

Total spend on privacy software tools.

Answer

Number of privacy patches applied.

Question 10

You are mapping personal data flows for a global enterprise. Which approach is most effective for demonstrating accountability under GDPR?

Accepted Answer

Maintaining a comprehensive Record of Processing Activities (ROPA).. A Record of Processing Activities (ROPA) is the primary accountability artifact under GDPR Article 30, documenting what personal data is processed, why, by whom, where, and for how long. Maintaining a comprehensive ROPA demonstrates accountability because it provides the authoritative map of data flows that regulators, DPOs, and auditors rely on to verify lawful processing. It is the foundational document that supports DPIAs, DSAR responses, and breach assessments.

Answer

Conducting periodic penetration tests.

Answer

Updating the external privacy policy annually.

Answer

Signing NDAs with all employees.

Question 11

A multinational company intends to implement a Global Privacy Policy. What is the greatest challenge to its effective governance?

Accepted Answer

Incompatible local regulatory mandates.. A Global Privacy Policy must satisfy every jurisdiction in which the company operates, and local privacy laws frequently impose conflicting requirements — for example, GDPR's data subject rights versus CCPA's opt-out model versus sectoral rules in healthcare or finance. These incompatible mandates create genuine legal conflicts that cannot be resolved by a single uniform policy without local addenda or derogations. This is the greatest governance challenge because it forces ongoing legal reconciliation rather than a one-time drafting exercise.

Answer

Lack of translation services.

Answer

Difficulty in choosing a document management system.

Answer

Inability to find a privacy officer for every region.

Answer

Resistance from the Marketing department.

Question 12

A CDPSE practitioner is integrating privacy controls into the SDLC. Which action best ensures privacy by design during the requirements gathering phase?

Accepted Answer

Conducting a privacy impact assessment on functional requirements.. Conducting a privacy impact assessment (PIA) or data protection impact assessment (DPIA) on functional requirements during requirements gathering embeds privacy by design at the earliest point, when changes are cheapest and most effective. It identifies how personal data will be collected, used, shared, and retained before any code is written, allowing privacy requirements to be specified alongside functional ones. This satisfies GDPR Article 25 (data protection by design and by default) and the CDPSE principle of integrating privacy into the SDLC from the start.

Answer

Installing a firewall after code completion.

Answer

Reviewing audit logs after the system launch.

Answer

Performing a DPIA after production deployment.

Question 13

What is the primary role of a Data Privacy Officer (DPO)?

Accepted Answer

Monitoring compliance and providing advice on data protection.. The DPO's primary role is to monitor compliance with data protection laws and internal policies, and to advise the organization and its employees on data protection obligations. This is an advisory and monitoring function, not an operational or executive decision-making role. It is defined explicitly under GDPR Articles 37-39.

Answer

Approving all business marketing budgets.

Answer

Managing the IT server infrastructure.

Answer

Developing all corporate software applications.

Question 14

When establishing a privacy steering committee, who should be included to ensure organizational support?

Accepted Answer

Senior representatives from Legal, IT, HR, and Marketing.. A privacy steering committee should include senior representatives from key stakeholder groups such as Legal, IT, HR, and Marketing to ensure diverse perspectives and organizational buy-in. This cross-functional representation ensures that privacy decisions consider legal requirements, technical feasibility, employee data, and customer-facing activities. Limiting to one department would miss critical input.

Answer

Only the Human Resources team.

Answer

External consultants only.

Answer

Only the IT staff.

Question 15

Which of the following is the most effective method for evaluating the maturity of a privacy governance program?

Accepted Answer

Using an established Privacy Capability Maturity Model (PCMM).. A Privacy Capability Maturity Model (PCMM) provides a structured, repeatable framework with defined maturity levels (e.g., initial, managed, defined, quantitatively managed, optimizing) against which the governance program's processes, controls, and outcomes can be objectively assessed. It is the only option that evaluates the program holistically across dimensions like policy, training, monitoring, and continuous improvement. This makes it the most effective and defensible method for measuring maturity.

Answer

Checking for the presence of a Privacy Impact Assessment template.

Answer

Reviewing the number of cookies on the public website.

Answer

Asking employees if they like the privacy policy.