CDPSE Privacy Risk Management And Compliance — Timed 15 Questions

Question 1

During a DPIA (Data Protection Impact Assessment), a CDPSE identifies a high risk to data subjects due to the use of AI-driven profiling. What is the appropriate next step?

Accepted Answer

Consult with the Data Protection Officer (DPO) to determine if regulatory consultation is necessary.. When a DPIA identifies high risk that cannot be mitigated, GDPR Article 36 requires the controller to consult the supervisory authority before processing; the DPO is the appropriate party to advise on whether such regulatory consultation is necessary and how to proceed. Consulting the DPO ensures the risk assessment is validated and the correct legal path is followed. This is the mandated escalation step, not a discretionary one.

Answer

Proceed with the project and monitor for data breaches.

Answer

Inform the public about the risk to maintain transparency.

Answer

Switch to a less intrusive profiling algorithm without re-evaluating the DPIA.

Question 2

A CDPSE practitioner is conducting a Privacy Impact Assessment (PIA) for a new marketing application. During the data flow mapping phase, they identify that PII is being transferred to a cloud service provider located in a non-equivalent jurisdiction. Which action should the practitioner prioritize to ensure compliance with the GDPR?

Accepted Answer

Execute Standard Contractual Clauses (SCCs) with the cloud service provider.. Under GDPR Chapter V, transfers of personal data to a third country without an adequacy decision require appropriate safeguards. Standard Contractual Clauses (SCCs) are the most widely used and immediately actionable transfer mechanism, and executing them with the cloud provider establishes a lawful basis for the transfer while imposing data protection obligations on the importer. This is the priority action because it directly addresses the compliance gap identified in the data flow mapping.

Answer

Disable the data transfer feature until a local data center is provisioned.

Answer

Perform a Data Protection Impact Assessment (DPIA) specifically for the transfer.

Answer

Update the Privacy Policy to inform users about the international transfer.

Question 3

Which of the following is the most critical element to include in a Privacy Notice under GDPR to fulfill the 'Right to be Informed'?

Accepted Answer

The legal basis for the processing of personal data.. GDPR Article 13(1)(c) requires the controller to inform the data subject of the legal basis for processing, which is the most critical element for the Right to be Informed because it establishes why the processing is lawful. Without stating the legal basis (consent, contract, legal obligation, vital interests, public task, or legitimate interests), the notice fails to meet the core transparency requirement.

Answer

The specific hardware models used for storage.

Answer

The name of the Chief Privacy Officer.

Answer

The company's annual revenue.

Question 4

A CDPSE is helping a startup draft its privacy notice. The startup collects email addresses and browsing behavior for marketing purposes. Which of the following must be included in the privacy notice to comply with the GDPR?

Accepted Answer

The identity and contact details of the data protection officer (DPO), if applicable.. GDPR Article 13(1)(b) requires the privacy notice to include the contact details of the DPO, if applicable. Other elements like the right to complain, retention criteria, and categories of recipients are also required, but naming a specific supervisory authority, exact retention periods, or an exhaustive list of third parties is not mandatory. Thus, the DPO's contact details are a required inclusion.

Answer

The name of the supervisory authority that will handle complaints.

Answer

A list of all third parties with whom data is shared.

Answer

The retention period for each data category.

Question 5

A CDPSE is conducting a privacy compliance review for a financial institution that processes customer data in the cloud. The institution must comply with GDPR and local banking regulations. Which TWO actions are essential to ensure that cross-border data transfers are lawful? (Choose two.)

Accepted Answer

Verify that the cloud provider's data centers are located in countries with adequate data protection laws or that appropriate safeguards like Standard Contractual Clauses (SCCs) are in place.. Lawful cross-border transfers under GDPR require either an adequacy decision or appropriate safeguards like SCCs, and a transfer impact assessment to evaluate the destination country's legal environment. These two actions are essential for compliance, especially for financial data. Consent, Privacy Shield certification, and encryption alone do not satisfy the legal requirements for transfers.

Answer

Ensure that the cloud provider is certified under the EU-U.S. Privacy Shield framework.

Answer

Implement end-to-end encryption for all data transfers to render the data unintelligible to unauthorized parties.

Answer

Obtain explicit consent from all customers for each cross-border transfer of their personal data.

Question 6

A CDPSE is reviewing the privacy program of a financial institution that operates in the EU and California. The institution is updating its privacy notice to comply with GDPR and CCPA/CPRA. Which two elements must be included in the privacy notice to satisfy both regulations? (Choose two.)

Accepted Answer

The retention period for each category of personal information. The two elements required by both GDPR and CCPA/CPRA are the categories of personal information collected and the retention period for each category. GDPR mandates transparency about data categories and retention, and CCPA/CPRA similarly requires disclosure of categories and retention periods. Other elements like the right to lodge a complaint or opt-out of sale are specific to one regulation.

Answer

The right to lodge a complaint with a supervisory authority

Answer

The legal basis for processing

Answer

The right to opt out of the sale or sharing of personal information

Question 7

A CDPSE is conducting a privacy risk assessment for a new cross-border data transfer from the EU to a third country. Which TWO mechanisms are valid under the GDPR to ensure an adequate level of protection? (Choose two.)

Accepted Answer

Standard Contractual Clauses (SCCs) approved by the European Commission.. Under GDPR Chapter V, valid transfer mechanisms include adequacy decisions, Standard Contractual Clauses, Binding Corporate Rules, and specific derogations. For a general cross-border transfer to a third country, SCCs and adequacy decisions are the most common and broadly applicable. Self-certification and verbal consent do not meet the legal requirements.

Answer

A self-certification by the data exporter that its security controls are sufficient.

Answer

Verbal consent from the data subjects obtained during a phone call.

Answer

A Binding Corporate Rules (BCR) framework approved by the competent supervisory authority.

Question 8

A company wants to collect geolocation data from mobile users. Which privacy principle should be applied first?

Accepted Answer

Data minimization by requesting access to precise location only when necessary.. Data minimization is the foundational privacy principle that requires collecting only the personal data actually needed for a stated purpose. For geolocation, precise GPS coordinates are highly sensitive and intrusive, so the first question must be whether precise location is even necessary — coarse location or on-demand access may suffice. Applying minimization first reduces the scope of every downstream control (encryption, retention, disclosure), making it the correct starting point.

Answer

Automated archival of location history after one week.

Answer

Publicly disclosing the use of geolocation in the privacy policy.

Answer

Full encryption of geolocation data in transit.

Question 9

A CDPSE is auditing a legacy application that stores passwords in plain text. What is the most effective immediate mitigation strategy?

Accepted Answer

Implement a salted hashing algorithm and re-hash all existing credentials.. Plain-text password storage is a critical vulnerability, and the most effective immediate mitigation is to replace it with a salted hashing algorithm (e.g., bcrypt, Argon2) and re-hash all existing credentials. Hashing is irreversible, so even if the database is compromised, attackers cannot recover the original passwords. Salting prevents rainbow-table and precomputation attacks, and re-hashing existing credentials closes the exposure window for current users.

Answer

Perform a Data Protection Impact Assessment (DPIA) to document the risk.

Answer

Conduct a data breach simulation to see if the vulnerability is exploitable.

Answer

Implement an access control list (ACL) to restrict who can see the plain text passwords.

Question 10

An organization is evaluating a cloud service provider (CSP) for storing sensitive customer data. Under the GDPR, what is the most critical step the CDPSE must perform to manage third-party privacy risk?

Accepted Answer

Execute a Data Processing Agreement (DPA) that mandates adherence to specific privacy instructions.. Under GDPR Article 28, when a controller engages a processor (such as a CSP), a Data Processing Agreement (DPA) is legally mandatory and must specify the subject matter, duration, nature and purpose of processing, types of personal data, categories of data subjects, and the obligations of the processor. Executing a DPA that mandates adherence to specific privacy instructions is the primary mechanism for managing third-party privacy risk because it creates enforceable contractual accountability. It also flows down GDPR obligations such as breach notification, sub-processor controls, and assistance with data subject rights.

Answer

Perform a penetration test on the CSP's multi-tenant environment.

Answer

Verify the CSP's physical data center location to ensure it is within the EU.

Answer

Review the CSP's SOC 2 Type II report for general system reliability.

Question 11

When mapping data flows to identify privacy risks, a practitioner discovers that personal data is being transferred to a non-affiliated third party. What is the immediate requirement?

Accepted Answer

Validate that the transfer is supported by an appropriate legal basis and documented in the Records of Processing Activities (ROPA).. When personal data is transferred to a non-affiliated third party, the immediate requirement is to ensure that the transfer has a valid legal basis under the applicable data protection law and that it is properly documented in the ROPA. This validates the lawfulness of the processing and creates accountability. Without a legal basis, the transfer would be unlawful, and documentation is required to demonstrate compliance.

Answer

Request the third party to delete the data until a contract is signed.

Answer

Disable the API endpoint connecting to the third party to prevent further data exposure.

Answer

Immediately notify the supervisory authority of the data transfer.

Question 12

A company is implementing a new CCPA compliance tool. Which feature should be used to automate the 'Right to Opt-Out' request process for web visitors?

Accepted Answer

Automated Consent Management Platform (CMP) configured with a 'Do Not Sell' signal.. An Automated Consent Management Platform (CMP) configured with a 'Do Not Sell' signal is the correct feature to automate the CCPA Right to Opt-Out for web visitors. CCPA/CPRA requires businesses to honor opt-out signals (including Global Privacy Control) and provide a clear mechanism for consumers to stop the sale or sharing of their personal information. A CMP captures the signal, records consent state, and propagates it to downstream ad tech and data partners automatically.

Answer

A manual email ticketing system for data subject access requests.

Answer

An automated script that permanently deletes user accounts after 30 days of inactivity.

Answer

An internal dashboard for employees to view customer purchase histories.

Question 13

A multinational company is transferring data between its US and EU subsidiaries. Which mechanism is most effective for ensuring cross-border data transfer compliance after the invalidation of previous frameworks?

Accepted Answer

Implementing Standard Contractual Clauses (SCCs) alongside a Transfer Impact Assessment (TIA).. Standard Contractual Clauses (SCCs) are the European Commission-approved contractual safeguards for transferring personal data to third countries, and pairing them with a Transfer Impact Assessment (TIA) addresses the post-Schrems II requirement to evaluate the destination country's laws and supplement protections where needed. Together they form the most defensible mechanism for lawful EU-US transfers after prior frameworks were invalidated. This combination is explicitly endorsed by the EDPB.

Answer

Restricting all data transfers to only encrypted tunnels.

Answer

Relying on the internal 'Group Privacy Policy' as an adequacy decision.

Answer

Self-certification under the U.S. Commerce Department's privacy program.

Question 14

A CDPSE practitioner is conducting a Privacy Impact Assessment (PIA) for a new marketing application that uses behavioral tracking. Which action should be prioritized to ensure compliance with privacy-by-design principles?

Accepted Answer

Incorporate data minimization and purpose limitation settings during the architectural design phase.. Privacy-by-design requires that privacy controls be embedded at the earliest architectural stage, not bolted on later. Data minimization and purpose limitation are foundational GDPR principles (Article 5) that must be designed into the application's data flows before any code is written. Addressing them during architectural design prevents costly retrofits and ensures the behavioral tracking only collects what is necessary for the stated marketing purpose.

Answer

Enable automated data deletion scripts after the application deployment phase.

Answer

Configure the database to encrypt all fields regardless of sensitivity to ensure maximum protection.

Answer

Conduct a post-implementation audit to identify potential data leakage points.

Question 15

What is the primary purpose of a Data Privacy Impact Assessment (DPIA)?

Accepted Answer

To identify and mitigate privacy risks associated with a new data processing activity.. A DPIA is a structured risk assessment required by GDPR Article 35 for processing activities likely to result in high risk to data subjects' rights and freedoms. Its core purpose is to identify privacy risks arising from a new or changed processing operation and to define mitigations before processing begins. It is a proactive, accountability-focused instrument, not a budgeting, training, or availability exercise.

Answer

To calculate the budget required for security hardware.

Answer

To train employees on the company's privacy policies.

Answer

To verify the system uptime requirements of the application.