CDPSE Privacy Risk Management And Compliance — All Questions With Answers

Question 1hardmultiple choice

Read the full Privacy Risk Management And Compliance explanation →

During a DPIA (Data Protection Impact Assessment), a CDPSE identifies a high risk to data subjects due to the use of AI-driven profiling. What is the appropriate next step?

Question 2mediummultiple choice

Read the full Privacy Risk Management And Compliance explanation →

A CDPSE practitioner is conducting a Privacy Impact Assessment (PIA) for a new marketing application. During the data flow mapping phase, they identify that PII is being transferred to a cloud service provider located in a non-equivalent jurisdiction. Which action should the practitioner prioritize to ensure compliance with the GDPR?

Question 3easymultiple choice

Read the full Privacy Risk Management And Compliance explanation →

Which of the following is the most critical element to include in a Privacy Notice under GDPR to fulfill the 'Right to be Informed'?

Question 4easymultiple choice

Read the full Privacy Risk Management And Compliance explanation →

A CDPSE is helping a startup draft its privacy notice. The startup collects email addresses and browsing behavior for marketing purposes. Which of the following must be included in the privacy notice to comply with the GDPR?

Question 5mediummulti select

Read the full Privacy Risk Management And Compliance explanation →

A CDPSE is conducting a privacy compliance review for a financial institution that processes customer data in the cloud. The institution must comply with GDPR and local banking regulations. Which TWO actions are essential to ensure that cross-border data transfers are lawful? (Choose two.)

Question 6hardmulti select

Read the full Privacy Risk Management And Compliance explanation →

A CDPSE is reviewing the privacy program of a financial institution that operates in the EU and California. The institution is updating its privacy notice to comply with GDPR and CCPA/CPRA. Which two elements must be included in the privacy notice to satisfy both regulations? (Choose two.)

Question 7hardmulti select

Read the full Privacy Risk Management And Compliance explanation →

A CDPSE is conducting a privacy risk assessment for a new cross-border data transfer from the EU to a third country. Which TWO mechanisms are valid under the GDPR to ensure an adequate level of protection? (Choose two.)

Question 8easymultiple choice

Read the full Privacy Risk Management And Compliance explanation →

A company wants to collect geolocation data from mobile users. Which privacy principle should be applied first?

Question 9hardmultiple choice

Read the full Privacy Risk Management And Compliance explanation →

A CDPSE is auditing a legacy application that stores passwords in plain text. What is the most effective immediate mitigation strategy?

Question 10hardmultiple choice

Read the full Privacy Risk Management And Compliance explanation →

An organization is evaluating a cloud service provider (CSP) for storing sensitive customer data. Under the GDPR, what is the most critical step the CDPSE must perform to manage third-party privacy risk?

Question 11easymultiple choice

Read the full Privacy Risk Management And Compliance explanation →

When mapping data flows to identify privacy risks, a practitioner discovers that personal data is being transferred to a non-affiliated third party. What is the immediate requirement?

Question 12mediummultiple choice

Read the full Privacy Risk Management And Compliance explanation →

A company is implementing a new CCPA compliance tool. Which feature should be used to automate the 'Right to Opt-Out' request process for web visitors?

Question 13mediummultiple choice

Read the full Privacy Risk Management And Compliance explanation →

A multinational company is transferring data between its US and EU subsidiaries. Which mechanism is most effective for ensuring cross-border data transfer compliance after the invalidation of previous frameworks?

Question 14mediummultiple choice

Read the full Privacy Risk Management And Compliance explanation →

A CDPSE practitioner is conducting a Privacy Impact Assessment (PIA) for a new marketing application that uses behavioral tracking. Which action should be prioritized to ensure compliance with privacy-by-design principles?

Question 15easymultiple choice

Read the full Privacy Risk Management And Compliance explanation →

What is the primary purpose of a Data Privacy Impact Assessment (DPIA)?

Question 16easymultiple choice

Read the full Privacy Risk Management And Compliance explanation →

Which document should a CDPSE review to understand the organization's legal basis for processing employee personal data?

Question 17hardmultiple choice

Read the full Privacy Risk Management And Compliance explanation →

When a third-party vendor reports a data breach, what is the first step the CDPSE should take?

Question 18mediummultiple choice

Read the full Privacy Risk Management And Compliance explanation →

A company is preparing for a CCPA audit. Which internal process is most important to demonstrate compliance regarding the 'Right to Know'?

Question 19mediummultiple choice

Read the full Privacy Risk Management And Compliance explanation →

Which technique should be used to protect personal data during software testing?

Question 20hardmultiple choice

Read the full Privacy Risk Management And Compliance explanation →

A company is using an automated system to make credit decisions. What is the main privacy concern regarding the 'Right to Explanation'?

Question 21easymultiple choice

Read the full Privacy Risk Management And Compliance explanation →

An organization's privacy policy is updated to reflect a new vendor. What is the most important follow-up action?

Question 22mediummultiple choice

Read the full Privacy Risk Management And Compliance explanation →

When conducting a privacy risk assessment, what is the significance of 'Data Lifecycle Management'?

Question 23easymultiple choice

Read the full Privacy Risk Management And Compliance explanation →

What does 'Privacy by Default' imply regarding system configuration?

Question 24hardmultiple choice

Read the full Privacy Risk Management And Compliance explanation →

A CDPSE is reviewing a vendor's privacy controls. Which finding would be considered a major non-compliance risk?

Question 25easymultiple choice

Read the full Privacy Risk Management And Compliance explanation →

What is the first step in creating a data inventory for a privacy program?

Question 26mediummultiple choice

Read the full Privacy Risk Management And Compliance explanation →

A company is implementing a Bring Your Own Device (BYOD) policy. What is the primary privacy challenge?

Question 27hardmultiple choice

Read the full Privacy Risk Management And Compliance explanation →

When evaluating a third-party's security, what should the CDPSE focus on to ensure effective privacy risk management?

Question 28mediummultiple choice

Read the full Privacy Risk Management And Compliance explanation →

How can a CDPSE ensure that personal data is only kept for as long as necessary?

Question 29hardmultiple choice

Read the full Privacy Risk Management And Compliance explanation →

A company is considering the use of a data broker. Which privacy risk is most significant?

Question 30mediummultiple choice

Read the full Privacy Risk Management And Compliance explanation →

During an audit, it is found that an application logs user session tokens including sensitive user IDs. What is the correct privacy recommendation?

Question 31mediummulti select

Read the full Privacy Risk Management And Compliance explanation →

Which THREE elements are essential in a Data Protection Impact Assessment (DPIA) report?

Question 32easymultiple choice

Read the full Privacy Risk Management And Compliance explanation →

A CDPSE is advising on a website redesign. What is the most important privacy-related feature for a contact form?

Question 33mediummulti select

Read the full Privacy Risk Management And Compliance explanation →

Which TWO actions should a CDPSE prioritize when assessing a vendor for privacy compliance?

Question 34easymulti select

Read the full Privacy Risk Management And Compliance explanation →

Which THREE documents are typically required for compliance with global privacy regulations?

Question 35mediummulti select

Read the full Privacy Risk Management And Compliance explanation →

When managing privacy risks, which TWO approaches help in 'Data Minimization'?

Question 36hardmulti select

Read the full Privacy Risk Management And Compliance explanation →

Which TWO factors must be considered when determining if a cross-border data transfer is lawful under GDPR?

Question 37hardmulti select

Read the full Privacy Risk Management And Compliance explanation →

Which THREE steps are vital when responding to a Data Subject Access Request (DSAR)?

Question 38easymulti select

Read the full Privacy Risk Management And Compliance explanation →

Which TWO actions should a CDPSE take to demonstrate 'Privacy by Design' in a software project?

Question 39hardmulti select

Read the full Privacy Risk Management And Compliance explanation →

Which THREE types of personal data are typically considered 'special category' or 'sensitive' data under privacy regulations?

Question 40mediummulti select

Read the full Privacy Risk Management And Compliance explanation →

Which TWO security measures are most effective in protecting against unauthorized access to PII?

Question 41hardmulti select

Read the full Privacy Risk Management And Compliance explanation →

Which THREE items should be included in a Privacy Policy that aligns with global transparency requirements?

Question 42hardmultiple choice

Read the full Privacy Risk Management And Compliance explanation →

Your organization is preparing for a CCPA/CPRA audit. You are asked to verify the 'Right to Opt-Out of Sale or Sharing' implementation. Which technical requirement must be validated to ensure compliance with the Global Privacy Control (GPC) signal?

Question 43easymultiple choice

Read the full Privacy Risk Management And Compliance explanation →

A third-party vendor is providing an API integration for customer support. As a CDPSE, what is the first step you should take in the third-party privacy risk management lifecycle?

Question 44mediummultiple choice

Read the full Privacy Risk Management And Compliance explanation →

During a Data Mapping exercise, the CDPSE discovers that a legacy database stores PII in cleartext. The system is scheduled for decommissioning in 18 months. What is the most appropriate privacy risk mitigation strategy?

Question 45hardmultiple choice

Read the full Privacy Risk Management And Compliance explanation →

An organization is implementing a 'Privacy by Design' framework for a machine learning model used to predict customer churn. Which technique should be utilized to minimize privacy risk while maintaining model utility?

Question 46mediummultiple choice

Read the full Privacy Risk Management And Compliance explanation →

A multinational company is evaluating a SaaS solution. As a CDPSE, you must ensure that the vendor's data retention policy aligns with your organization's internal privacy standards. Where should this requirement be formally documented?

Question 47mediummulti select

Read the full Privacy Risk Management And Compliance explanation →

When establishing a Privacy Risk Assessment methodology, which TWO components are essential to ensure the assessment is repeatable and defensible?

Question 48hardmulti select

Read the full Privacy Risk Management And Compliance explanation →

Which THREE activities should be included in an organization's privacy compliance monitoring program to identify potential regulatory non-compliance?

Question 49mediummulti select

Read the full Privacy Risk Management And Compliance explanation →

In the event of a personal data breach, which TWO actions are required to satisfy the notification obligations under many modern privacy regulations (e.g., GDPR)?

Question 50hardmultiple choice

Read the full Privacy Risk Management And Compliance explanation →

A multinational bank is implementing a new AI-driven credit scoring system that processes personal data of EU residents. The CDPSE must ensure the processing complies with GDPR. Which of the following is the MOST appropriate action to take FIRST?

Question 51mediummultiple choice

Read the full Privacy Risk Management And Compliance explanation →

A multinational retailer is designing a new loyalty program that offers personalized discounts based on purchase history. The privacy team must ensure that the program complies with the GDPR's data protection by design and by default requirements. Which of the following should be implemented FIRST to meet these obligations?

Question 52mediummultiple choice

Read the full Privacy Risk Management And Compliance explanation →

A multinational retailer is expanding its e-commerce operations into Brazil. The privacy team must determine whether the country's data protection authority can impose administrative fines directly on the company for privacy violations. Which legal framework should the CDPSE reference to assess this enforcement risk?

Question 53mediummultiple choice

Read the full Privacy Risk Management And Compliance explanation →

A CDPSE is reviewing the organization's data retention practices. The organization stores customer personal data indefinitely because storage costs are low. Which principle of privacy risk management is being violated?

Question 54hardmultiple choice

Read the full Privacy Risk Management And Compliance explanation →

A CDPSE is reviewing the organization's data retention schedule. The legal team has determined that customer records must be kept for seven years to comply with tax regulations. However, the marketing department wants to keep the data indefinitely for future analytics. Which principle should guide the CDPSE's recommendation?

Question 55mediummultiple choice

Read the full Privacy Risk Management And Compliance explanation →

A multinational retailer collects customer email addresses for marketing. The company plans to use a new cloud-based email service provider located in a different jurisdiction. The CDPSE must ensure the transfer complies with the GDPR. Which mechanism is specifically designed to allow such transfers while providing appropriate safeguards?

Question 56hardmulti select

Read the full Privacy Risk Management And Compliance explanation →

A CDPSE is advising a healthcare organization on complying with the HIPAA Privacy Rule. Which TWO actions are required to properly manage patient authorizations for use and disclosure of protected health information (PHI)? (Choose two.)

Question 57mediummultiple choice

Read the full Privacy Risk Management And Compliance explanation →

A multinational retailer is implementing a new customer loyalty program that collects purchase history and email addresses across its stores in the EU and the US. The CDPSE is asked to ensure the program complies with the GDPR's data protection by design and by default requirements. Which action should the CDPSE recommend FIRST?

Question 58mediummultiple choice

Read the full Privacy Risk Management And Compliance explanation →

A healthcare provider in the EU is migrating patient records to a cloud service provider based in the United States. The CDPSE must ensure the transfer complies with GDPR Chapter V. Which of the following is the MOST appropriate mechanism to legitimize the transfer?

Question 59hardmultiple choice

Read the full Privacy Risk Management And Compliance explanation →

A CDPSE is conducting a privacy risk assessment for a new mobile health app that collects sensitive health data. The app uses a third-party analytics SDK that transmits data to servers in a non-adequate country. The CDPSE must recommend controls to mitigate privacy risks. Which control is most effective in reducing the risk of unauthorized access during transmission?

Question 60mediummultiple choice

Read the full Privacy Risk Management And Compliance explanation →

A CDPSE is reviewing the data retention practices of a healthcare provider that stores patient records in a cloud environment. The provider operates in multiple jurisdictions with varying retention requirements. Which approach best ensures compliance with privacy regulations while minimizing data storage risks?

Question 61mediummultiple choice

Read the full Privacy Risk Management And Compliance explanation →

A CDPSE is reviewing a new employee monitoring system that tracks keystrokes and screenshots. The system will be deployed globally. Which privacy principle is most directly implicated by this monitoring?

Question 62mediummultiple choice

Read the full Privacy Risk Management And Compliance explanation →

A multinational retailer is implementing a new customer loyalty program that collects purchase history, location data, and device identifiers. The privacy team must determine the lawful basis for processing under the GDPR. The program requires customers to agree to share data with third-party marketing partners. Which lawful basis is most appropriate for this processing activity?

Question 63mediummultiple choice

Read the full Privacy Risk Management And Compliance explanation →

A CDPSE is designing the privacy risk register for a new mobile health application that continuously transmits heart-rate and sleep data to a cloud analytics platform. The organization wants to demonstrate that privacy risks are managed consistently with enterprise risk appetite. Which approach BEST integrates privacy risk into the existing enterprise risk management framework?

Question 64hardmultiple choice

Read the full Privacy Risk Management And Compliance explanation →

A CDPSE is advising a software company that develops a mobile fitness app. The app collects heart rate, sleep patterns, and location data. The company wants to use this data to provide personalized health insights and also share anonymized data with research partners. Which privacy risk is MOST critical to address before launching the app?

Question 65hardmultiple choice

Read the full Privacy Risk Management And Compliance explanation →

A CDPSE is conducting a privacy risk assessment for a cloud-based HR system that processes employee data across multiple jurisdictions. The system uses a third-party subprocessor for payroll analytics. The CDPSE must ensure compliance with data transfer restrictions. Which mechanism is most appropriate for ensuring lawful transfers from the EU to the subprocessor in a country without an adequacy decision?

Question 66mediummulti select

Read the full Privacy Risk Management And Compliance explanation →

A CDPSE is assessing the organization's readiness for a data subject access request (DSAR) under the GDPR. The organization processes data in multiple systems, including a CRM, email marketing platform, and HR database. Which TWO steps are essential to ensure timely and complete responses to DSARs? (Choose two.)

Question 67hardmultiple choice

Read the full Privacy Risk Management And Compliance explanation →

A multinational retailer processes customer loyalty data across the EU, UK and Brazil. The CDPSE is asked to establish a privacy compliance monitoring program that provides assurance to the board. Which control objective is MOST important for demonstrating ongoing compliance with diverse regulatory requirements?

Question 68mediummultiple choice

Read the full Privacy Risk Management And Compliance explanation →

A healthcare organization experiences a data breach involving unauthorized access to patient records. The CDPSE must determine if notification to supervisory authorities is required under GDPR. Which factor is most critical in making this determination?

Question 69easymultiple choice

Read the full Privacy Risk Management And Compliance explanation →

A CDPSE is reviewing a new marketing initiative that will use email addresses and purchase history to create lookalike audiences on a social media platform. The legal team has confirmed that the organization has a legitimate interest basis for the original collection. Which action should the CDPSE recommend FIRST to manage privacy risk?

Question 70mediummulti select

Read the full Privacy Risk Management And Compliance explanation →

A CDPSE is advising a financial services firm that wants to outsource its customer call recording and analytics to a cloud provider. The recordings contain personal data and some payment card information. The firm must ensure the outsourcing arrangement meets privacy and compliance expectations. Which TWO actions should the CDPSE recommend as part of the vendor risk management process? (Choose two.)

Question 71mediummultiple choice

Read the full Privacy Risk Management And Compliance explanation →

A multinational retailer is implementing a new customer loyalty program that collects purchase history, location data, and communication preferences across its mobile app and in-store point-of-sale systems. The CDPSE is asked to ensure that the privacy notice provided to customers meets the transparency requirements of the GDPR and similar laws. Which of the following is the MOST critical element to include in the privacy notice to satisfy these requirements?

Question 72easymultiple choice

Read the full Privacy Risk Management And Compliance explanation →

A CDPSE is reviewing the privacy program of a small e-commerce company that sells to customers in California. The company has not updated its privacy policy in two years and does not have a process for handling consumer requests. Which requirement under the California Consumer Privacy Act (CCPA) as amended by the CPRA is the company MOST likely failing to meet?

Question 73hardmultiple choice

Read the full Privacy Risk Management And Compliance explanation →

A CDPSE is evaluating the effectiveness of a privacy program's risk treatment plan. The organization has implemented a new consent management platform that records and honors user preferences across web and mobile channels. Which metric BEST demonstrates that the treatment has reduced the risk of processing without valid consent?

Question 74hardmulti select

Read the full Privacy Risk Management And Compliance explanation →

A CDPSE is reviewing a healthcare organization's data retention practices. The organization stores patient medical records, billing information, and appointment scheduling data in a cloud-based electronic health record (EHR) system. The CDPSE must ensure compliance with privacy regulations that require data to be kept only as long as necessary. Which TWO of the following actions are the MOST effective to establish and maintain a defensible data retention schedule? (Choose two.)

Question 75easymultiple choice

Read the full Privacy Risk Management And Compliance explanation →

A CDPSE is advising a startup that has developed a mobile app for tracking fitness activities. The app collects users' heart rate, sleep patterns, and GPS location. The startup plans to use this data to provide personalized health insights and also to share aggregated data with research partners. Before launching, the CDPSE must ensure that the privacy policy reflects the appropriate legal basis for processing. Which of the following is the MOST appropriate legal basis for processing this health and location data under the GDPR?

Question 76easymultiple choice

Read the full Privacy Risk Management And Compliance explanation →

A CDPSE is advising a startup that wants to implement a privacy-by-design approach for a new mobile app. Which principle should be prioritized first to ensure data protection is integrated from the outset?

Question 77hardmultiple choice

Read the full Privacy Risk Management And Compliance explanation →

A CDPSE is conducting a privacy risk assessment for a new cloud-based human resources (HR) system that will process employee personal data, including performance evaluations, disciplinary records, and health information for benefits administration. The system is hosted by a third-party vendor in a different jurisdiction. The CDPSE must identify the MOST significant privacy risk associated with this arrangement. Which of the following is the MOST critical risk to address?

Question 78mediummultiple choice

Read the full Privacy Risk Management And Compliance explanation →

A CDPSE is reviewing the privacy program of a financial institution that operates in multiple countries. The institution has a centralized privacy policy but allows local branches to implement additional measures as needed. During an audit, the CDPSE finds that one branch has been using customer data for a new marketing campaign without updating the privacy notice or obtaining fresh consent. Which of the following actions should the CDPSE recommend FIRST to address this non-compliance?

Question 79mediummultiple choice

Read the full Privacy Risk Management And Compliance explanation →

A CDPSE is implementing a privacy program for a U.S. company that processes personal data of EU residents. The company has not appointed a representative in the EU. Under the GDPR, which requirement is most directly violated?

Question 80hardmultiple choice

Read the full Privacy Risk Management And Compliance explanation →

A CDPSE is assessing a new automated decision-making system that profiles customers for credit approvals. The system uses machine learning and operates in the EU. Which GDPR requirement must be addressed before deployment?

Question 81mediummultiple choice

Read the full Privacy Risk Management And Compliance explanation →

A CDPSE is reviewing a data processing agreement (DPA) with a new cloud vendor that will process personal data on behalf of a controller. Which clause is essential to include in the DPA under GDPR Article 28?

Question 82easymultiple choice

Read the full Privacy Risk Management And Compliance explanation →

A CDPSE is helping a company respond to a data subject access request (DSAR) under the GDPR. Which action is required to comply with Article 15?

Question 1hardmultiple choice

Read the full Privacy Risk Management And Compliance explanation →

During a DPIA (Data Protection Impact Assessment), a CDPSE identifies a high risk to data subjects due to the use of AI-driven profiling. What is the appropriate next step?

Question 2mediummultiple choice

Read the full Privacy Risk Management And Compliance explanation →

A CDPSE practitioner is conducting a Privacy Impact Assessment (PIA) for a new marketing application. During the data flow mapping phase, they identify that PII is being transferred to a cloud service provider located in a non-equivalent jurisdiction. Which action should the practitioner prioritize to ensure compliance with the GDPR?

Question 3easymultiple choice

Read the full Privacy Risk Management And Compliance explanation →

Which of the following is the most critical element to include in a Privacy Notice under GDPR to fulfill the 'Right to be Informed'?

Question 4easymultiple choice

Read the full Privacy Risk Management And Compliance explanation →

A CDPSE is helping a startup draft its privacy notice. The startup collects email addresses and browsing behavior for marketing purposes. Which of the following must be included in the privacy notice to comply with the GDPR?

Question 5mediummulti select

Read the full Privacy Risk Management And Compliance explanation →

A CDPSE is conducting a privacy compliance review for a financial institution that processes customer data in the cloud. The institution must comply with GDPR and local banking regulations. Which TWO actions are essential to ensure that cross-border data transfers are lawful? (Choose two.)

Question 6hardmulti select

Read the full Privacy Risk Management And Compliance explanation →

A CDPSE is reviewing the privacy program of a financial institution that operates in the EU and California. The institution is updating its privacy notice to comply with GDPR and CCPA/CPRA. Which two elements must be included in the privacy notice to satisfy both regulations? (Choose two.)

Question 7hardmulti select

Read the full Privacy Risk Management And Compliance explanation →

A CDPSE is conducting a privacy risk assessment for a new cross-border data transfer from the EU to a third country. Which TWO mechanisms are valid under the GDPR to ensure an adequate level of protection? (Choose two.)

Question 8easymultiple choice

Read the full Privacy Risk Management And Compliance explanation →

A company wants to collect geolocation data from mobile users. Which privacy principle should be applied first?

Question 9hardmultiple choice

Read the full Privacy Risk Management And Compliance explanation →

A CDPSE is auditing a legacy application that stores passwords in plain text. What is the most effective immediate mitigation strategy?

Question 10hardmultiple choice

Read the full Privacy Risk Management And Compliance explanation →

An organization is evaluating a cloud service provider (CSP) for storing sensitive customer data. Under the GDPR, what is the most critical step the CDPSE must perform to manage third-party privacy risk?

Question 11easymultiple choice

Read the full Privacy Risk Management And Compliance explanation →

When mapping data flows to identify privacy risks, a practitioner discovers that personal data is being transferred to a non-affiliated third party. What is the immediate requirement?

Question 12mediummultiple choice

Read the full Privacy Risk Management And Compliance explanation →

A company is implementing a new CCPA compliance tool. Which feature should be used to automate the 'Right to Opt-Out' request process for web visitors?

Question 13mediummultiple choice

Read the full Privacy Risk Management And Compliance explanation →

A multinational company is transferring data between its US and EU subsidiaries. Which mechanism is most effective for ensuring cross-border data transfer compliance after the invalidation of previous frameworks?

Question 14mediummultiple choice

Read the full Privacy Risk Management And Compliance explanation →

A CDPSE practitioner is conducting a Privacy Impact Assessment (PIA) for a new marketing application that uses behavioral tracking. Which action should be prioritized to ensure compliance with privacy-by-design principles?

Question 15easymultiple choice

Read the full Privacy Risk Management And Compliance explanation →

What is the primary purpose of a Data Privacy Impact Assessment (DPIA)?

Question 16easymultiple choice

Read the full Privacy Risk Management And Compliance explanation →

Which document should a CDPSE review to understand the organization's legal basis for processing employee personal data?

Question 17hardmultiple choice

Read the full Privacy Risk Management And Compliance explanation →

When a third-party vendor reports a data breach, what is the first step the CDPSE should take?

Question 18mediummultiple choice

Read the full Privacy Risk Management And Compliance explanation →

A company is preparing for a CCPA audit. Which internal process is most important to demonstrate compliance regarding the 'Right to Know'?

Question 19mediummultiple choice

Read the full Privacy Risk Management And Compliance explanation →

Which technique should be used to protect personal data during software testing?

Question 20hardmultiple choice

Read the full Privacy Risk Management And Compliance explanation →

A company is using an automated system to make credit decisions. What is the main privacy concern regarding the 'Right to Explanation'?

Question 21easymultiple choice

Read the full Privacy Risk Management And Compliance explanation →

An organization's privacy policy is updated to reflect a new vendor. What is the most important follow-up action?

Question 22mediummultiple choice

Read the full Privacy Risk Management And Compliance explanation →

When conducting a privacy risk assessment, what is the significance of 'Data Lifecycle Management'?

Question 23easymultiple choice

Read the full Privacy Risk Management And Compliance explanation →

What does 'Privacy by Default' imply regarding system configuration?

Question 24hardmultiple choice

Read the full Privacy Risk Management And Compliance explanation →

A CDPSE is reviewing a vendor's privacy controls. Which finding would be considered a major non-compliance risk?

Question 25easymultiple choice

Read the full Privacy Risk Management And Compliance explanation →

What is the first step in creating a data inventory for a privacy program?

Question 26mediummultiple choice

Read the full Privacy Risk Management And Compliance explanation →

A company is implementing a Bring Your Own Device (BYOD) policy. What is the primary privacy challenge?

Question 27hardmultiple choice

Read the full Privacy Risk Management And Compliance explanation →

When evaluating a third-party's security, what should the CDPSE focus on to ensure effective privacy risk management?

Question 28mediummultiple choice

Read the full Privacy Risk Management And Compliance explanation →

How can a CDPSE ensure that personal data is only kept for as long as necessary?

Question 29hardmultiple choice

Read the full Privacy Risk Management And Compliance explanation →

A company is considering the use of a data broker. Which privacy risk is most significant?

Question 30mediummultiple choice

Read the full Privacy Risk Management And Compliance explanation →

During an audit, it is found that an application logs user session tokens including sensitive user IDs. What is the correct privacy recommendation?

Question 31mediummulti select

Read the full Privacy Risk Management And Compliance explanation →

Which THREE elements are essential in a Data Protection Impact Assessment (DPIA) report?

Question 32easymultiple choice

Read the full Privacy Risk Management And Compliance explanation →

A CDPSE is advising on a website redesign. What is the most important privacy-related feature for a contact form?

Question 33mediummulti select

Read the full Privacy Risk Management And Compliance explanation →

Which TWO actions should a CDPSE prioritize when assessing a vendor for privacy compliance?

Question 34easymulti select

Read the full Privacy Risk Management And Compliance explanation →

Which THREE documents are typically required for compliance with global privacy regulations?

Question 35mediummulti select

Read the full Privacy Risk Management And Compliance explanation →

When managing privacy risks, which TWO approaches help in 'Data Minimization'?

Question 36hardmulti select

Read the full Privacy Risk Management And Compliance explanation →

Which TWO factors must be considered when determining if a cross-border data transfer is lawful under GDPR?

Question 37hardmulti select

Read the full Privacy Risk Management And Compliance explanation →

Which THREE steps are vital when responding to a Data Subject Access Request (DSAR)?

Question 38easymulti select

Read the full Privacy Risk Management And Compliance explanation →

Which TWO actions should a CDPSE take to demonstrate 'Privacy by Design' in a software project?

Question 39hardmulti select

Read the full Privacy Risk Management And Compliance explanation →

Which THREE types of personal data are typically considered 'special category' or 'sensitive' data under privacy regulations?

Question 40mediummulti select

Read the full Privacy Risk Management And Compliance explanation →

Which TWO security measures are most effective in protecting against unauthorized access to PII?

Question 41hardmulti select

Read the full Privacy Risk Management And Compliance explanation →

Which THREE items should be included in a Privacy Policy that aligns with global transparency requirements?

Question 42hardmultiple choice

Read the full Privacy Risk Management And Compliance explanation →

Your organization is preparing for a CCPA/CPRA audit. You are asked to verify the 'Right to Opt-Out of Sale or Sharing' implementation. Which technical requirement must be validated to ensure compliance with the Global Privacy Control (GPC) signal?

Question 43easymultiple choice

Read the full Privacy Risk Management And Compliance explanation →

A third-party vendor is providing an API integration for customer support. As a CDPSE, what is the first step you should take in the third-party privacy risk management lifecycle?

Question 44mediummultiple choice

Read the full Privacy Risk Management And Compliance explanation →

During a Data Mapping exercise, the CDPSE discovers that a legacy database stores PII in cleartext. The system is scheduled for decommissioning in 18 months. What is the most appropriate privacy risk mitigation strategy?

Question 45hardmultiple choice

Read the full Privacy Risk Management And Compliance explanation →

An organization is implementing a 'Privacy by Design' framework for a machine learning model used to predict customer churn. Which technique should be utilized to minimize privacy risk while maintaining model utility?

Question 46mediummultiple choice

Read the full Privacy Risk Management And Compliance explanation →

A multinational company is evaluating a SaaS solution. As a CDPSE, you must ensure that the vendor's data retention policy aligns with your organization's internal privacy standards. Where should this requirement be formally documented?

Question 47mediummulti select

Read the full Privacy Risk Management And Compliance explanation →

When establishing a Privacy Risk Assessment methodology, which TWO components are essential to ensure the assessment is repeatable and defensible?

Question 48hardmulti select

Read the full Privacy Risk Management And Compliance explanation →

Which THREE activities should be included in an organization's privacy compliance monitoring program to identify potential regulatory non-compliance?

Question 49mediummulti select

Read the full Privacy Risk Management And Compliance explanation →

In the event of a personal data breach, which TWO actions are required to satisfy the notification obligations under many modern privacy regulations (e.g., GDPR)?

Question 50hardmultiple choice

Read the full Privacy Risk Management And Compliance explanation →

A multinational bank is implementing a new AI-driven credit scoring system that processes personal data of EU residents. The CDPSE must ensure the processing complies with GDPR. Which of the following is the MOST appropriate action to take FIRST?

Question 51mediummultiple choice

Read the full Privacy Risk Management And Compliance explanation →

A multinational retailer is designing a new loyalty program that offers personalized discounts based on purchase history. The privacy team must ensure that the program complies with the GDPR's data protection by design and by default requirements. Which of the following should be implemented FIRST to meet these obligations?

Question 52mediummultiple choice

Read the full Privacy Risk Management And Compliance explanation →

A multinational retailer is expanding its e-commerce operations into Brazil. The privacy team must determine whether the country's data protection authority can impose administrative fines directly on the company for privacy violations. Which legal framework should the CDPSE reference to assess this enforcement risk?

Question 53mediummultiple choice

Read the full Privacy Risk Management And Compliance explanation →

A CDPSE is reviewing the organization's data retention practices. The organization stores customer personal data indefinitely because storage costs are low. Which principle of privacy risk management is being violated?

Question 54hardmultiple choice

Read the full Privacy Risk Management And Compliance explanation →

A CDPSE is reviewing the organization's data retention schedule. The legal team has determined that customer records must be kept for seven years to comply with tax regulations. However, the marketing department wants to keep the data indefinitely for future analytics. Which principle should guide the CDPSE's recommendation?

Question 55mediummultiple choice

Read the full Privacy Risk Management And Compliance explanation →

A multinational retailer collects customer email addresses for marketing. The company plans to use a new cloud-based email service provider located in a different jurisdiction. The CDPSE must ensure the transfer complies with the GDPR. Which mechanism is specifically designed to allow such transfers while providing appropriate safeguards?

Question 56hardmulti select

Read the full Privacy Risk Management And Compliance explanation →

A CDPSE is advising a healthcare organization on complying with the HIPAA Privacy Rule. Which TWO actions are required to properly manage patient authorizations for use and disclosure of protected health information (PHI)? (Choose two.)

Question 57mediummultiple choice

Read the full Privacy Risk Management And Compliance explanation →

A multinational retailer is implementing a new customer loyalty program that collects purchase history and email addresses across its stores in the EU and the US. The CDPSE is asked to ensure the program complies with the GDPR's data protection by design and by default requirements. Which action should the CDPSE recommend FIRST?

Question 58mediummultiple choice

Read the full Privacy Risk Management And Compliance explanation →

A healthcare provider in the EU is migrating patient records to a cloud service provider based in the United States. The CDPSE must ensure the transfer complies with GDPR Chapter V. Which of the following is the MOST appropriate mechanism to legitimize the transfer?

Question 59hardmultiple choice

Read the full Privacy Risk Management And Compliance explanation →

A CDPSE is conducting a privacy risk assessment for a new mobile health app that collects sensitive health data. The app uses a third-party analytics SDK that transmits data to servers in a non-adequate country. The CDPSE must recommend controls to mitigate privacy risks. Which control is most effective in reducing the risk of unauthorized access during transmission?

Question 60mediummultiple choice

Read the full Privacy Risk Management And Compliance explanation →

A CDPSE is reviewing the data retention practices of a healthcare provider that stores patient records in a cloud environment. The provider operates in multiple jurisdictions with varying retention requirements. Which approach best ensures compliance with privacy regulations while minimizing data storage risks?

Question 61mediummultiple choice

Read the full Privacy Risk Management And Compliance explanation →

A CDPSE is reviewing a new employee monitoring system that tracks keystrokes and screenshots. The system will be deployed globally. Which privacy principle is most directly implicated by this monitoring?

Question 62mediummultiple choice

Read the full Privacy Risk Management And Compliance explanation →

A multinational retailer is implementing a new customer loyalty program that collects purchase history, location data, and device identifiers. The privacy team must determine the lawful basis for processing under the GDPR. The program requires customers to agree to share data with third-party marketing partners. Which lawful basis is most appropriate for this processing activity?

Question 63mediummultiple choice

Read the full Privacy Risk Management And Compliance explanation →

A CDPSE is designing the privacy risk register for a new mobile health application that continuously transmits heart-rate and sleep data to a cloud analytics platform. The organization wants to demonstrate that privacy risks are managed consistently with enterprise risk appetite. Which approach BEST integrates privacy risk into the existing enterprise risk management framework?

Question 64hardmultiple choice

Read the full Privacy Risk Management And Compliance explanation →

A CDPSE is advising a software company that develops a mobile fitness app. The app collects heart rate, sleep patterns, and location data. The company wants to use this data to provide personalized health insights and also share anonymized data with research partners. Which privacy risk is MOST critical to address before launching the app?

Question 65hardmultiple choice

Read the full Privacy Risk Management And Compliance explanation →

A CDPSE is conducting a privacy risk assessment for a cloud-based HR system that processes employee data across multiple jurisdictions. The system uses a third-party subprocessor for payroll analytics. The CDPSE must ensure compliance with data transfer restrictions. Which mechanism is most appropriate for ensuring lawful transfers from the EU to the subprocessor in a country without an adequacy decision?

Question 66mediummulti select

Read the full Privacy Risk Management And Compliance explanation →

A CDPSE is assessing the organization's readiness for a data subject access request (DSAR) under the GDPR. The organization processes data in multiple systems, including a CRM, email marketing platform, and HR database. Which TWO steps are essential to ensure timely and complete responses to DSARs? (Choose two.)

Question 67hardmultiple choice

Read the full Privacy Risk Management And Compliance explanation →

A multinational retailer processes customer loyalty data across the EU, UK and Brazil. The CDPSE is asked to establish a privacy compliance monitoring program that provides assurance to the board. Which control objective is MOST important for demonstrating ongoing compliance with diverse regulatory requirements?

Question 68mediummultiple choice

Read the full Privacy Risk Management And Compliance explanation →

A healthcare organization experiences a data breach involving unauthorized access to patient records. The CDPSE must determine if notification to supervisory authorities is required under GDPR. Which factor is most critical in making this determination?

Question 69easymultiple choice

Read the full Privacy Risk Management And Compliance explanation →

A CDPSE is reviewing a new marketing initiative that will use email addresses and purchase history to create lookalike audiences on a social media platform. The legal team has confirmed that the organization has a legitimate interest basis for the original collection. Which action should the CDPSE recommend FIRST to manage privacy risk?

Question 70mediummulti select

Read the full Privacy Risk Management And Compliance explanation →

A CDPSE is advising a financial services firm that wants to outsource its customer call recording and analytics to a cloud provider. The recordings contain personal data and some payment card information. The firm must ensure the outsourcing arrangement meets privacy and compliance expectations. Which TWO actions should the CDPSE recommend as part of the vendor risk management process? (Choose two.)

Question 71mediummultiple choice

Read the full Privacy Risk Management And Compliance explanation →

A multinational retailer is implementing a new customer loyalty program that collects purchase history, location data, and communication preferences across its mobile app and in-store point-of-sale systems. The CDPSE is asked to ensure that the privacy notice provided to customers meets the transparency requirements of the GDPR and similar laws. Which of the following is the MOST critical element to include in the privacy notice to satisfy these requirements?

Question 72easymultiple choice

Read the full Privacy Risk Management And Compliance explanation →

A CDPSE is reviewing the privacy program of a small e-commerce company that sells to customers in California. The company has not updated its privacy policy in two years and does not have a process for handling consumer requests. Which requirement under the California Consumer Privacy Act (CCPA) as amended by the CPRA is the company MOST likely failing to meet?

Question 73hardmultiple choice

Read the full Privacy Risk Management And Compliance explanation →

A CDPSE is evaluating the effectiveness of a privacy program's risk treatment plan. The organization has implemented a new consent management platform that records and honors user preferences across web and mobile channels. Which metric BEST demonstrates that the treatment has reduced the risk of processing without valid consent?

Question 74hardmulti select

Read the full Privacy Risk Management And Compliance explanation →

A CDPSE is reviewing a healthcare organization's data retention practices. The organization stores patient medical records, billing information, and appointment scheduling data in a cloud-based electronic health record (EHR) system. The CDPSE must ensure compliance with privacy regulations that require data to be kept only as long as necessary. Which TWO of the following actions are the MOST effective to establish and maintain a defensible data retention schedule? (Choose two.)

Question 75easymultiple choice

Read the full Privacy Risk Management And Compliance explanation →

A CDPSE is advising a startup that has developed a mobile app for tracking fitness activities. The app collects users' heart rate, sleep patterns, and GPS location. The startup plans to use this data to provide personalized health insights and also to share aggregated data with research partners. Before launching, the CDPSE must ensure that the privacy policy reflects the appropriate legal basis for processing. Which of the following is the MOST appropriate legal basis for processing this health and location data under the GDPR?

Question 76easymultiple choice

Read the full Privacy Risk Management And Compliance explanation →

A CDPSE is advising a startup that wants to implement a privacy-by-design approach for a new mobile app. Which principle should be prioritized first to ensure data protection is integrated from the outset?

Question 77hardmultiple choice

Read the full Privacy Risk Management And Compliance explanation →

A CDPSE is conducting a privacy risk assessment for a new cloud-based human resources (HR) system that will process employee personal data, including performance evaluations, disciplinary records, and health information for benefits administration. The system is hosted by a third-party vendor in a different jurisdiction. The CDPSE must identify the MOST significant privacy risk associated with this arrangement. Which of the following is the MOST critical risk to address?

Question 78mediummultiple choice

Read the full Privacy Risk Management And Compliance explanation →

A CDPSE is reviewing the privacy program of a financial institution that operates in multiple countries. The institution has a centralized privacy policy but allows local branches to implement additional measures as needed. During an audit, the CDPSE finds that one branch has been using customer data for a new marketing campaign without updating the privacy notice or obtaining fresh consent. Which of the following actions should the CDPSE recommend FIRST to address this non-compliance?

Question 79mediummultiple choice

Read the full Privacy Risk Management And Compliance explanation →

A CDPSE is implementing a privacy program for a U.S. company that processes personal data of EU residents. The company has not appointed a representative in the EU. Under the GDPR, which requirement is most directly violated?

Question 80hardmultiple choice

Read the full Privacy Risk Management And Compliance explanation →

A CDPSE is assessing a new automated decision-making system that profiles customers for credit approvals. The system uses machine learning and operates in the EU. Which GDPR requirement must be addressed before deployment?

Question 81mediummultiple choice

Read the full Privacy Risk Management And Compliance explanation →

A CDPSE is reviewing a data processing agreement (DPA) with a new cloud vendor that will process personal data on behalf of a controller. Which clause is essential to include in the DPA under GDPR Article 28?

Question 82easymultiple choice

Read the full Privacy Risk Management And Compliance explanation →