CDPSE Privacy Risk Management And Compliance Practice Test 5 — 15 Questions

Question 1

A CDPSE is reviewing a new employee monitoring system that tracks keystrokes and screenshots. The system will be deployed globally. Which privacy principle is most directly implicated by this monitoring?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Data minimization. Data minimization is most directly implicated because keystroke logging and screenshots collect extensive personal data that is likely disproportionate to the legitimate purpose of monitoring. GDPR requires that only necessary data be collected, making this principle central to assessing the system's compliance.

Answer

Storage limitation

Answer

Purpose limitation

Answer

Integrity and confidentiality

Question 2

A multinational retailer is implementing a new customer loyalty program that collects purchase history, location data, and device identifiers. The privacy team must determine the lawful basis for processing under the GDPR. The program requires customers to agree to share data with third-party marketing partners. Which lawful basis is most appropriate for this processing activity?

Accepted Answer

Consent. The correct basis is consent because the processing involves sharing personal data with third-party marketing partners, which is not necessary for contract performance or legal compliance, and legitimate interests would likely be overridden by data subject rights. Consent ensures individuals have control over their data and is explicitly required when data is used for marketing beyond the original purpose.

Answer

Legitimate interests

Answer

Contractual necessity

Answer

Legal obligation

Question 3

A CDPSE is designing the privacy risk register for a new mobile health application that continuously transmits heart-rate and sleep data to a cloud analytics platform. The organization wants to demonstrate that privacy risks are managed consistently with enterprise risk appetite. Which approach BEST integrates privacy risk into the existing enterprise risk management framework?

Accepted Answer

Map privacy risk scenarios to the enterprise likelihood and impact scales and assign owners through the existing risk governance process.. Integrating privacy risk into enterprise risk management requires using the organization's existing likelihood and impact scales, governance structures and ownership model. This enables privacy risks to be evaluated alongside other risks, prioritized consistently and managed within the same treatment and reporting cycles. A separate or purely legal approach fragments risk oversight and weakens accountability.

Answer

Use a qualitative heat map without numeric scores so that privacy risks are not compared against financial or operational risks.

Answer

Maintain a separate privacy risk register scored on a 1–5 scale defined by the privacy team and report it only to the chief privacy officer.

Answer

Treat all privacy risks as compliance issues and track them in the legal department's obligation register until they are closed.

Question 4

A CDPSE is advising a software company that develops a mobile fitness app. The app collects heart rate, sleep patterns, and location data. The company wants to use this data to provide personalized health insights and also share anonymized data with research partners. Which privacy risk is MOST critical to address before launching the app?

Accepted Answer

The potential for re-identification of anonymized data when combined with other datasets.. The most critical privacy risk is re-identification of anonymized data, especially given the sensitivity of health and location data. Anonymization is often reversible when combined with other datasets, leading to potential privacy breaches and legal non-compliance. While consent, encryption, and compatibility are relevant, they do not address the fundamental risk of re-identification that could invalidate the entire data sharing model.

Answer

The cost of implementing encryption for data at rest and in transit.

Answer

The need to obtain user consent for collecting heart rate and sleep data.

Answer

The app's ability to function across different mobile operating systems.

Question 5

A CDPSE is conducting a privacy risk assessment for a cloud-based HR system that processes employee data across multiple jurisdictions. The system uses a third-party subprocessor for payroll analytics. The CDPSE must ensure compliance with data transfer restrictions. Which mechanism is most appropriate for ensuring lawful transfers from the EU to the subprocessor in a country without an adequacy decision?

Accepted Answer

Standard Contractual Clauses (SCCs). Standard Contractual Clauses are the most appropriate mechanism because they are pre-approved by the European Commission and can be used with external subprocessors in countries lacking an adequacy decision. They impose data protection obligations on the importer and are legally binding. Other mechanisms like BCRs are for intra-group transfers, Privacy Shield is invalid, and derogations are for occasional transfers.

Answer

Privacy Shield certification

Answer

Binding Corporate Rules (BCRs)

Answer

Derogation for contractual necessity

Question 6

A CDPSE is assessing the organization's readiness for a data subject access request (DSAR) under the GDPR. The organization processes data in multiple systems, including a CRM, email marketing platform, and HR database. Which TWO steps are essential to ensure timely and complete responses to DSARs? (Choose two.)

Accepted Answer

Establish a process to verify the identity of the requester before releasing data.. To handle DSARs effectively, organizations must track requests centrally to meet deadlines and verify requester identity to prevent unauthorized disclosures. Deleting data, charging fees, or requiring database specifics are non-compliant practices. These two steps are foundational for a defensible DSAR process under GDPR.

Answer

Automatically delete all data upon receiving a DSAR to simplify the process.

Answer

Require the requester to specify the exact database where their data is stored.

Answer

Charge a fee for each DSAR to cover administrative costs.

Question 7

A multinational retailer processes customer loyalty data across the EU, UK and Brazil. The CDPSE is asked to establish a privacy compliance monitoring program that provides assurance to the board. Which control objective is MOST important for demonstrating ongoing compliance with diverse regulatory requirements?

Accepted Answer

Timely identification and remediation of gaps between actual processing activities and documented privacy requirements.. For board-level assurance across multiple jurisdictions, the most important control objective is the ability to detect and remediate gaps between actual processing and documented privacy requirements. This demonstrates that compliance is actively monitored and corrected, rather than relying on indirect metrics such as training or complaint handling. It directly addresses the risk of regulatory breaches in a complex, multi-jurisdictional environment.

Answer

Percentage of customer complaints resolved within the service-level agreement.

Answer

Number of privacy impact assessments completed per quarter.

Answer

Annual privacy training completion rate for all employees who handle personal data.

Question 8

A healthcare organization experiences a data breach involving unauthorized access to patient records. The CDPSE must determine if notification to supervisory authorities is required under GDPR. Which factor is most critical in making this determination?

Accepted Answer

The likelihood and severity of risk to data subjects' rights and freedoms. The most critical factor is the likelihood and severity of risk to data subjects' rights and freedoms, as specified in GDPR Article 33. This assessment determines whether the breach must be reported to the supervisory authority. Other factors like number of records, encryption, and duration are elements to consider within that risk assessment, but they are not standalone determinants.

Answer

Whether the data was encrypted at rest

Answer

The duration of the unauthorized access

Answer

The number of records affected

Question 9

A CDPSE is reviewing a new marketing initiative that will use email addresses and purchase history to create lookalike audiences on a social media platform. The legal team has confirmed that the organization has a legitimate interest basis for the original collection. Which action should the CDPSE recommend FIRST to manage privacy risk?

Accepted Answer

Conduct a legitimate interest assessment to confirm that the new use is compatible with the original purpose and that data subject rights are not overridden.. When repurposing personal data, the first step is to assess compatibility with the original purpose and confirm that the legitimate interest basis remains valid. This assessment determines whether additional safeguards, transparency or a different legal basis are needed. Updating notices or anonymizing data may follow, but they do not replace the need to establish a lawful basis for the new processing.

Answer

Anonymize the email addresses and purchase history before sharing with the social media platform.

Answer

Obtain fresh consent from all customers whose data will be used for lookalike audiences.

Answer

Immediately update the privacy notice to include lookalike audience creation and proceed with the campaign.

Question 10

A CDPSE is advising a financial services firm that wants to outsource its customer call recording and analytics to a cloud provider. The recordings contain personal data and some payment card information. The firm must ensure the outsourcing arrangement meets privacy and compliance expectations. Which TWO actions should the CDPSE recommend as part of the vendor risk management process? (Choose two.)

Accepted Answer

Require the vendor to provide evidence of independent third-party certifications and audit reports relevant to privacy and security.. Effective vendor risk management for sensitive data includes independent assurance through certifications and audits, and enforceable contractual clauses that define data protection obligations, breach notification and audit rights. Together, these actions provide the firm with evidence of the vendor's controls and the legal means to enforce compliance, while preserving the firm's accountability.

Answer

Allow the vendor to use the data for its own product improvement purposes to reduce costs.

Answer

Rely on the vendor's standard terms of service without customization to expedite the contract.

Answer

Transfer all accountability for data protection compliance to the vendor through a liability waiver.

Question 11

A multinational retailer is implementing a new customer loyalty program that collects purchase history, location data, and communication preferences across its mobile app and in-store point-of-sale systems. The CDPSE is asked to ensure that the privacy notice provided to customers meets the transparency requirements of the GDPR and similar laws. Which of the following is the MOST critical element to include in the privacy notice to satisfy these requirements?

Accepted Answer

The specific purposes of processing, the legal basis for each purpose, and the categories of recipients of the personal data.. The GDPR and similar laws require privacy notices to be specific and meaningful, not merely generic statements. Data subjects must be informed of the purposes of processing, the legal basis relied upon for each purpose, and the categories of recipients to whom data will be disclosed. This enables individuals to understand how their data is used and to exercise their rights effectively. The other options either provide insufficient detail or focus on irrelevant information such as internal security measures.

Answer

A detailed description of the organization's internal data security measures, including encryption algorithms and access controls.

Answer

A statement that the organization complies with all applicable data protection laws.

Answer

A list of all third-party vendors that have access to personal data, including their contact details.

Question 12

A CDPSE is reviewing the privacy program of a small e-commerce company that sells to customers in California. The company has not updated its privacy policy in two years and does not have a process for handling consumer requests. Which requirement under the California Consumer Privacy Act (CCPA) as amended by the CPRA is the company MOST likely failing to meet?

Accepted Answer

The requirement to respond to consumer requests to know, delete, or correct personal information within 45 days.. The company is most likely failing to meet the CCPA/CPRA requirement to respond to consumer requests to know, delete, or correct personal information within 45 days. Without a process, the company cannot honor these rights, which is a core obligation. The other options either misstate the law or are conditional requirements not necessarily applicable here.

Answer

The requirement to appoint a Data Protection Officer (DPO) to oversee privacy compliance.

Answer

The requirement to provide a clear and conspicuous link titled 'Do Not Sell or Share My Personal Information' on the homepage.

Answer

The requirement to obtain opt-in consent from all consumers before collecting any personal information.

Question 13

A CDPSE is evaluating the effectiveness of a privacy program's risk treatment plan. The organization has implemented a new consent management platform that records and honors user preferences across web and mobile channels. Which metric BEST demonstrates that the treatment has reduced the risk of processing without valid consent?

Accepted Answer

The percentage of processing activities that are blocked or adjusted when consent is absent or withdrawn.. To demonstrate that a consent management platform reduces the risk of processing without valid consent, the organization must measure enforcement—whether processing is actually blocked or adjusted when consent is absent or withdrawn. This metric directly ties the control to the risk. Other metrics, such as acceptance rates or record counts, reflect activity or user behavior but not the effectiveness of the control in preventing invalid processing.

Answer

The percentage of users who accept all cookies on the first visit.

Answer

The average time taken to display the consent banner on page load.

Answer

The number of consent records stored in the platform.

Question 14

A CDPSE is reviewing a healthcare organization's data retention practices. The organization stores patient medical records, billing information, and appointment scheduling data in a cloud-based electronic health record (EHR) system. The CDPSE must ensure compliance with privacy regulations that require data to be kept only as long as necessary. Which TWO of the following actions are the MOST effective to establish and maintain a defensible data retention schedule? (Choose two.)

Accepted Answer

Implement automated deletion or anonymization processes that trigger at the end of each defined retention period.. Establishing a defensible retention schedule begins with knowing what data exists and what rules apply, which is achieved through a data inventory and classification. Then, the schedule must be enforced through automation to ensure timely deletion or anonymization. These two actions together provide the necessary foundation and operational mechanism. The other options either violate storage limitation principles or fail to ensure consistent compliance across the organization.

Answer

Store all patient data indefinitely to ensure it is available for future medical research or legal claims.

Answer

Document the retention schedule in a policy but allow individual departments to deviate as needed without central oversight.

Answer

Rely on the cloud provider's default retention settings for the EHR system to manage data lifecycle.

Question 15

A CDPSE is advising a startup that has developed a mobile app for tracking fitness activities. The app collects users' heart rate, sleep patterns, and GPS location. The startup plans to use this data to provide personalized health insights and also to share aggregated data with research partners. Before launching, the CDPSE must ensure that the privacy policy reflects the appropriate legal basis for processing. Which of the following is the MOST appropriate legal basis for processing this health and location data under the GDPR?

Accepted Answer

Explicit consent, obtained from users after providing clear information about the processing purposes.. Processing health data (heart rate, sleep) and precise location data falls under special categories of personal data under the GDPR, requiring a higher legal basis. Explicit consent is the most appropriate and commonly used basis for such processing, as it ensures individuals are fully informed and agree to the specific uses. Other legal bases like legitimate interests, contract performance, or vital interests are either insufficient or inapplicable for sensitive data in this context.

Answer

Vital interests, because the health insights could potentially save lives in emergency situations.

Answer

Performance of a contract, because users agree to the app's terms of service upon download.

Answer

Legitimate interests, because the app provides benefits to users and research partners.