CDPSE Privacy Risk Management And Compliance Practice Test 4 — 15 Questions

Question 1

A multinational company is evaluating a SaaS solution. As a CDPSE, you must ensure that the vendor's data retention policy aligns with your organization's internal privacy standards. Where should this requirement be formally documented?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

In the Data Processing Agreement (DPA).. The Data Processing Agreement (DPA) is the formal contract between a data controller and a data processor that specifies how personal data will be processed, including retention periods, deletion obligations, and security measures. Under GDPR Article 28 and similar privacy regulations, the DPA is the legally binding instrument where the vendor's data retention commitments must be documented to align with the organization's privacy standards.

Answer

In the software's 'About' page.

Answer

In the end-user licensing agreement (EULA).

Answer

In the marketing brochure provided by the vendor.

Question 2

When establishing a Privacy Risk Assessment methodology, which TWO components are essential to ensure the assessment is repeatable and defensible?

Accepted Answer

Defined risk appetite and tolerance thresholds.. Option C is correct because a defined risk appetite and tolerance thresholds establish the objective criteria that determine which risks are acceptable, ensuring every assessor reaches consistent, defensible conclusions across repeated assessments. Option E is correct because a standardized risk scoring matrix provides a consistent, documented method for assigning likelihood and impact values, which is fundamental to producing repeatable and comparable risk ratings. Together, these two components remove subjective judgment and create an auditable, reproducible assessment process. Option A is incorrect because automated deletion of all PII is a data-minimization or remediation action, not a component of assessment methodology, and would destroy data needed for analysis. Option B is incorrect because public disclosure of internal audit findings is a transparency decision unrelated to making assessments repeatable or defensible, and could itself create risk. Option D is incorrect because relying exclusively on external consultants undermines repeatability and internal ownership rather than ensuring it.

Answer

Automated deletion of all PII.

Answer

Public disclosure of all internal audit findings.

Answer

Exclusive use of external consultants for all assessments.

Question 3

Which THREE activities should be included in an organization's privacy compliance monitoring program to identify potential regulatory non-compliance?

Accepted Answer

Periodic privacy control self-assessments.. Option B (Periodic privacy control self-assessments) is correct because recurring self-assessments evaluate whether implemented privacy controls (e.g., access reviews, retention enforcement) still meet regulatory requirements such as GDPR or CCPA, surfacing gaps before an audit or breach. Option C (Automated data discovery to identify unauthorized PII storage) is correct because tools like data loss prevention (DLP), Microsoft Purview, or BigID scan repositories and endpoints for unclassified or shadow-IT PII, directly detecting non-compliant data handling and enabling remediation. Option D (Regular testing of privacy awareness training) is correct because testing employees via quizzes or phishing-style simulations verifies that training on handling personal data, consent, and breach reporting is effective, which many privacy regulations require as evidence of accountability. Option A is incorrect because blanket blocking of all inbound email is an availability/security measure, not a privacy compliance monitoring activity, and would disrupt legitimate business communications. Option E is incorrect because adjusting executive compensation has no bearing on identifying privacy regulatory non-compliance and is unrelated to monitoring controls or data handling.

Answer

Automated blocking of all inbound email traffic.

Answer

Increasing the executive leadership's salary.

Question 4

In the event of a personal data breach, which TWO actions are required to satisfy the notification obligations under many modern privacy regulations (e.g., GDPR)?

Accepted Answer

Notification to the relevant Supervisory Authority.. Option D is correct because under GDPR Article 33, the controller must notify the relevant Supervisory Authority of a personal data breach without undue delay and, where feasible, no later than 72 hours after becoming aware of it, unless the breach is unlikely to result in a risk to data subjects' rights and freedoms. Option E is correct because under GDPR Article 34, when a breach is likely to result in a high risk to the rights and freedoms of data subjects, the controller must also communicate the breach to the affected data subjects without undue delay, using clear and plain language. Option A is incorrect because destroying all backup tapes is not a notification obligation and could actually impede breach investigation, remediation, and legal compliance. Option B is incorrect because paying a fine is a potential consequence of non-compliance, not a required notification action following a breach. Option C is incorrect because a public social media announcement is not a prescribed notification channel; notifications must go to the Supervisory Authority and, when required, directly to affected data subjects.

Answer

Destruction of all backup tapes to prevent further access.

Answer

Payment of a fine to the local government.

Answer

Immediate public announcement on social media.

Question 5

A multinational bank is implementing a new AI-driven credit scoring system that processes personal data of EU residents. The CDPSE must ensure the processing complies with GDPR. Which of the following is the MOST appropriate action to take FIRST?

Accepted Answer

Conduct a Data Protection Impact Assessment (DPIA) because the processing involves systematic and extensive evaluation of personal aspects based on automated processing.. The correct answer is to conduct a DPIA first because GDPR mandates it for high-risk processing like AI-driven credit scoring. A DPIA systematically evaluates risks and helps determine necessary safeguards. Other actions like obtaining consent or appointing a DPO may be required later but are not the initial compliance step for this scenario.

Answer

Obtain explicit consent from all data subjects, as automated decision-making always requires explicit consent under GDPR.

Answer

Implement pseudonymization of the data before processing to eliminate privacy risks.

Answer

Appoint a Data Protection Officer (DPO) because any organization using AI must have a DPO.

Question 6

A multinational retailer is designing a new loyalty program that offers personalized discounts based on purchase history. The privacy team must ensure that the program complies with the GDPR's data protection by design and by default requirements. Which of the following should be implemented FIRST to meet these obligations?

Accepted Answer

Conduct a data protection impact assessment (DPIA) before the program goes live.. Under GDPR Article 35, a DPIA must be carried out prior to processing that is likely to result in a high risk, such as profiling. The DPIA identifies risks and informs the design of the loyalty program, ensuring privacy by design and by default. Other measures like consent or cookie banners are important but follow the risk assessment.

Answer

Implement a cookie banner that allows users to opt out of tracking.

Answer

Obtain explicit consent from all participants for profiling.

Answer

Appoint a Data Protection Officer (DPO) to oversee the program.

Question 7

A multinational retailer is expanding its e-commerce operations into Brazil. The privacy team must determine whether the country's data protection authority can impose administrative fines directly on the company for privacy violations. Which legal framework should the CDPSE reference to assess this enforcement risk?

Accepted Answer

Lei Geral de Proteção de Dados (LGPD). The LGPD is Brazil's primary data protection law, and it grants the ANPD the power to investigate and sanction organizations for non-compliance. For a retailer expanding into Brazil, the LGPD is the correct framework to assess potential fines and enforcement actions. Other laws like GDPR or CCPA may have extraterritorial reach, but they do not govern Brazilian enforcement.

Answer

Asia-Pacific Economic Cooperation (APEC) Cross-Border Privacy Rules (CBPR) System

Answer

General Data Protection Regulation (GDPR)

Answer

California Consumer Privacy Act (CCPA)

Question 8

A CDPSE is reviewing the organization's data retention practices. The organization stores customer personal data indefinitely because storage costs are low. Which principle of privacy risk management is being violated?

Accepted Answer

Storage limitation. The correct answer is storage limitation because personal data must not be kept longer than necessary. Indefinite retention violates this principle. Organizations must establish and enforce retention schedules, and delete or anonymize data when the purpose expires. Other principles like data minimization or security are important but do not directly address the duration of storage.

Answer

Integrity and confidentiality

Answer

Lawfulness, fairness, and transparency

Answer

Data minimization

Question 9

A CDPSE is reviewing the organization's data retention schedule. The legal team has determined that customer records must be kept for seven years to comply with tax regulations. However, the marketing department wants to keep the data indefinitely for future analytics. Which principle should guide the CDPSE's recommendation?

Accepted Answer

Storage limitation. Storage limitation mandates that personal data be kept only as long as necessary for the specified purposes. The tax regulation sets a seven-year retention requirement; beyond that, retaining data for marketing analytics lacks a lawful basis and violates storage limitation. The CDPSE should recommend deletion after the legal period unless a new justified purpose exists.

Answer

Integrity and confidentiality

Answer

Purpose limitation

Answer

Data minimization

Question 10

A multinational retailer collects customer email addresses for marketing. The company plans to use a new cloud-based email service provider located in a different jurisdiction. The CDPSE must ensure the transfer complies with the GDPR. Which mechanism is specifically designed to allow such transfers while providing appropriate safeguards?

Accepted Answer

Standard Contractual Clauses (SCCs). Standard Contractual Clauses are a robust, pre-approved legal mechanism under GDPR for transferring personal data to countries without an adequacy decision. They impose data protection obligations on both parties and are widely used for vendor engagements. Other options like BCRs apply only within corporate groups, Privacy Shield is invalid, and consent is impractical for ongoing transfers.

Answer

Binding Corporate Rules (BCRs)

Answer

Privacy Shield Framework

Answer

Consent of the data subjects

Question 11

A CDPSE is advising a healthcare organization on complying with the HIPAA Privacy Rule. Which TWO actions are required to properly manage patient authorizations for use and disclosure of protected health information (PHI)? (Choose two.)

Accepted Answer

Permit patients to revoke their authorization at any time, in writing, except to the extent that the covered entity has already taken action in reliance on it.. The correct answers are obtaining valid written authorization for marketing and allowing patients to revoke authorizations at any time. HIPAA mandates patient authorization for marketing uses and grants revocation rights. These actions empower patients and ensure compliance. Other options are incorrect because they misstate authorization requirements for research, suggest invalid blanket authorizations, or permit unauthorized law enforcement disclosures.

Answer

Disclose PHI to law enforcement without authorization if the patient is a suspect in a criminal investigation.

Answer

Use a single authorization form to cover all future uses and disclosures of PHI to streamline operations.

Answer

Ensure that authorizations for research purposes are obtained only if the research involves direct contact with patients.

Question 12

A multinational retailer is implementing a new customer loyalty program that collects purchase history and email addresses across its stores in the EU and the US. The CDPSE is asked to ensure the program complies with the GDPR's data protection by design and by default requirements. Which action should the CDPSE recommend FIRST?

Accepted Answer

Conduct a data protection impact assessment (DPIA) to identify and mitigate privacy risks before processing begins.. A DPIA is mandated by GDPR Article 35 for processing likely to result in high risk, and a new loyalty program involving purchase history and email across multiple countries qualifies. It proactively identifies privacy risks and ensures data protection by design and by default. Other measures like encryption, privacy notices, or consent are important but follow the risk assessment and design phase.

Answer

Obtain explicit consent from all customers before collecting any purchase history data.

Answer

Draft a privacy notice to inform customers about the loyalty program's data collection practices.

Answer

Implement encryption for all customer email addresses stored in the loyalty database.

Question 13

A healthcare provider in the EU is migrating patient records to a cloud service provider based in the United States. The CDPSE must ensure the transfer complies with GDPR Chapter V. Which of the following is the MOST appropriate mechanism to legitimize the transfer?

Accepted Answer

Standard Contractual Clauses (SCCs) with a transfer impact assessment.. For transfers from the EU to the US, Standard Contractual Clauses (SCCs) are a primary mechanism, but they must be supplemented by a transfer impact assessment to ensure adequate protection. Binding Corporate Rules apply to intra-group transfers, derogations are for occasional transfers, and Privacy Shield is invalid. Thus, SCCs with a TIA are the most appropriate.

Answer

Binding Corporate Rules (BCRs).

Answer

Derogations under Article 49, such as explicit consent.

Answer

Privacy Shield certification.

Question 14

A CDPSE is conducting a privacy risk assessment for a new mobile health app that collects sensitive health data. The app uses a third-party analytics SDK that transmits data to servers in a non-adequate country. The CDPSE must recommend controls to mitigate privacy risks. Which control is most effective in reducing the risk of unauthorized access during transmission?

Accepted Answer

Implementing end-to-end encryption for data in transit. End-to-end encryption is the most effective control to prevent unauthorized access to sensitive health data while in transit. It ensures confidentiality even if the data passes through third-party infrastructure or jurisdictions with weak privacy laws. Other options are important but do not directly secure the data transmission itself.

Answer

Obtaining user consent for data transfer

Answer

Conducting a vendor security assessment

Answer

Anonymizing the data before transmission

Question 15

A CDPSE is reviewing the data retention practices of a healthcare provider that stores patient records in a cloud environment. The provider operates in multiple jurisdictions with varying retention requirements. Which approach best ensures compliance with privacy regulations while minimizing data storage risks?

Accepted Answer

Implement a records retention schedule that aligns with legal and regulatory requirements in each jurisdiction, and securely delete data once retention periods expire.. A jurisdiction-specific retention schedule ensures compliance with varying legal requirements and enforces secure deletion after retention periods expire. This approach adheres to storage limitation and data minimization principles, reducing legal and security risks. Other options either retain data indefinitely, ignore jurisdictional differences, or rely on patient action, all of which fail to meet regulatory obligations.

Answer

Encrypt all patient records and retain them until the patient requests deletion.

Answer

Store all patient records in a single, centralized database with strong access controls, regardless of jurisdiction.

Answer

Retain all patient records indefinitely to ensure availability for future legal or medical needs.