CDPSE Privacy Risk Management And Compliance — 20 Questions

Question 1

During a DPIA (Data Protection Impact Assessment), a CDPSE identifies a high risk to data subjects due to the use of AI-driven profiling. What is the appropriate next step?

Accepted Answer

Consult with the Data Protection Officer (DPO) to determine if regulatory consultation is necessary.. Consultation with the DPO is required when a DPIA identifies a high risk that cannot be mitigated by the project team.

Answer

Proceed with the project and monitor for data breaches.

Answer

Inform the public about the risk to maintain transparency.

Answer

Switch to a less intrusive profiling algorithm without re-evaluating the DPIA.

Question 2

A company wants to collect geolocation data from mobile users. Which privacy principle should be applied first?

Accepted Answer

Data minimization by requesting access to precise location only when necessary.. Purpose limitation (specifically, data minimization and consent) is the first step in collecting sensitive data.

Answer

Automated archival of location history after one week.

Answer

Publicly disclosing the use of geolocation in the privacy policy.

Answer

Full encryption of geolocation data in transit.

Question 3

A CDPSE is auditing a legacy application that stores passwords in plain text. What is the most effective immediate mitigation strategy?

Accepted Answer

Implement a salted hashing algorithm and re-hash all existing credentials.. Immediate remediation of the vulnerability is required, followed by a formal risk assessment of the exposure.

Answer

Perform a Data Protection Impact Assessment (DPIA) to document the risk.

Answer

Conduct a data breach simulation to see if the vulnerability is exploitable.

Answer

Implement an access control list (ACL) to restrict who can see the plain text passwords.

Question 4

An organization is evaluating a cloud service provider (CSP) for storing sensitive customer data. Under the GDPR, what is the most critical step the CDPSE must perform to manage third-party privacy risk?

Accepted Answer

Execute a Data Processing Agreement (DPA) that mandates adherence to specific privacy instructions.. The CDPSE must ensure a Data Processing Agreement (DPA) is in place, as it is the legal mechanism defining the responsibilities of the data processor.

Answer

Perform a penetration test on the CSP's multi-tenant environment.

Answer

Verify the CSP's physical data center location to ensure it is within the EU.

Answer

Review the CSP's SOC 2 Type II report for general system reliability.

Question 5

When mapping data flows to identify privacy risks, a practitioner discovers that personal data is being transferred to a non-affiliated third party. What is the immediate requirement?

Accepted Answer

Validate that the transfer is supported by an appropriate legal basis and documented in the Records of Processing Activities (ROPA).. The inventory must identify the purpose and legal basis for the transfer before processing continues.

Answer

Request the third party to delete the data until a contract is signed.

Answer

Disable the API endpoint connecting to the third party to prevent further data exposure.

Answer

Immediately notify the supervisory authority of the data transfer.

Question 6

A company is implementing a new CCPA compliance tool. Which feature should be used to automate the 'Right to Opt-Out' request process for web visitors?

Accepted Answer

Automated Consent Management Platform (CMP) configured with a 'Do Not Sell' signal.. The 'Do Not Sell' link/mechanism is a mandatory CCPA requirement for businesses that sell personal information.

Answer

A manual email ticketing system for data subject access requests.

Answer

An automated script that permanently deletes user accounts after 30 days of inactivity.

Answer

An internal dashboard for employees to view customer purchase histories.

Question 7

A multinational company is transferring data between its US and EU subsidiaries. Which mechanism is most effective for ensuring cross-border data transfer compliance after the invalidation of previous frameworks?

Accepted Answer

Implementing Standard Contractual Clauses (SCCs) alongside a Transfer Impact Assessment (TIA).. Standard Contractual Clauses (SCCs) are the most widely used legal mechanism for international data transfers.

Answer

Restricting all data transfers to only encrypted tunnels.

Answer

Relying on the internal 'Group Privacy Policy' as an adequacy decision.

Answer

Self-certification under the U.S. Commerce Department's privacy program.

Question 8

A CDPSE practitioner is conducting a Privacy Impact Assessment (PIA) for a new marketing application that uses behavioral tracking. Which action should be prioritized to ensure compliance with privacy-by-design principles?

Accepted Answer

Incorporate data minimization and purpose limitation settings during the architectural design phase.. Privacy-by-design requires integrating privacy controls at the development stage rather than as an afterthought.

Answer

Enable automated data deletion scripts after the application deployment phase.

Answer

Configure the database to encrypt all fields regardless of sensitivity to ensure maximum protection.

Answer

Conduct a post-implementation audit to identify potential data leakage points.

Question 9

What is the primary purpose of a Data Privacy Impact Assessment (DPIA)?

Accepted Answer

To identify and mitigate privacy risks associated with a new data processing activity.. The primary goal of a DPIA is to identify and minimize privacy risks in a project or processing activity.

Answer

To calculate the budget required for security hardware.

Answer

To train employees on the company's privacy policies.

Answer

To verify the system uptime requirements of the application.

Question 10

Which document should a CDPSE review to understand the organization's legal basis for processing employee personal data?

Accepted Answer

The Record of Processing Activities (ROPA).. The Privacy Notice or the internal Record of Processing Activities (ROPA) outlines the legal basis for processing.

Answer

The vendor management list.

Answer

The firewall configuration log.

Answer

The employee handbook.

Question 11

When a third-party vendor reports a data breach, what is the first step the CDPSE should take?

Accepted Answer

Activate the incident response plan to assess the scope and notify affected individuals if required.. The immediate step is to follow the Incident Response Plan (IRP) to assess the impact and initiate containment.

Answer

Review the vendor's insurance policy coverage.

Answer

Demand the vendor perform an independent audit of their systems.

Answer

Suspend all services provided by the vendor immediately.

Question 12

A company is preparing for a CCPA audit. Which internal process is most important to demonstrate compliance regarding the 'Right to Know'?

Accepted Answer

A fully updated data inventory map showing data lineage.. The Right to Know requires that the organization can produce a record of what data was collected, why, and with whom it was shared.

Answer

Marketing brochures describing the product features.

Answer

The latest penetration test report for the customer portal.

Answer

A list of all employees with database access.

Question 13

Which technique should be used to protect personal data during software testing?

Accepted Answer

Data masking or using synthetic data sets.. Data masking or anonymization is the standard practice for using production data in non-production environments.

Answer

Implementing strict multi-factor authentication for developers.

Answer

Full encryption of the test database.

Answer

Restricting the test environment access to only senior engineers.

Question 14

A company is using an automated system to make credit decisions. What is the main privacy concern regarding the 'Right to Explanation'?

Accepted Answer

The lack of human intervention in automated decision-making processes.. Automated decision-making (ADM) requires transparency so that data subjects can understand why a decision was made.

Answer

The system is too slow for real-time credit processing.

Answer

The cost of maintaining the automated system infrastructure.

Answer

The inability of the system to process non-numeric data types.

Question 15

An organization's privacy policy is updated to reflect a new vendor. What is the most important follow-up action?

Accepted Answer

Communicating the privacy policy update to the data subjects.. Transparency is a core principle; individuals must be notified of changes that affect their data rights.

Answer

Archiving the previous version of the privacy policy for internal records.

Answer

Requesting a new SOC 2 report from the new vendor.

Answer

Updating the internal audit schedule to include the new vendor.

Question 16

When conducting a privacy risk assessment, what is the significance of 'Data Lifecycle Management'?

Accepted Answer

It identifies privacy risks at each stage from collection to deletion.. Understanding the lifecycle (collection to disposal) is necessary to ensure privacy is managed at every stage.

Answer

It reduces the power consumption of the storage systems.

Answer

It determines the software development methodology.

Answer

It ensures that the database is always updated with the latest patches.

Question 17

What does 'Privacy by Default' imply regarding system configuration?

Accepted Answer

The system is pre-configured with the strictest privacy settings.. Privacy by default means that the most restrictive privacy settings are applied automatically without user action.

Answer

Systems are configured to be open until the user manually secures them.

Answer

Users are required to opt-in to all marketing emails.

Answer

Data is deleted after 30 days if not accessed by an administrator.

Question 18

A CDPSE is reviewing a vendor's privacy controls. Which finding would be considered a major non-compliance risk?

Accepted Answer

The vendor lacks a documented process for handling data subject erasure requests.. Failure to provide a data subject right to erasure is a critical violation of privacy regulations.

Answer

The vendor uses a different database encryption algorithm than the organization.

Answer

The vendor's privacy policy is not written in the user's native language.

Answer

The vendor only updates their privacy policy once every two years.

Question 19

What is the first step in creating a data inventory for a privacy program?

Accepted Answer

Identifying and locating the personal data held by the organization.. Identifying data assets is the prerequisite for all other privacy management activities.

Answer

Defining the organization's data retention schedule.

Answer

Appointing a Data Protection Officer.

Answer

Drafting a new privacy policy.

Question 20

A company is implementing a Bring Your Own Device (BYOD) policy. What is the primary privacy challenge?

Accepted Answer

Separating corporate data from personal data to maintain user privacy.. Mixing personal and professional data on one device creates a risk of unauthorized access or over-collection by the organization.

Answer

Ensuring the device battery lasts for the entire workday.

Answer

Ensuring that all devices use the same operating system version.

Answer

Managing the cellular data costs of employees.