CAS-004 Governance, Risk, and Compliance Practice Question
A small business is implementing a privacy impact assessment (PIA) for a new application that processes personal data of EU citizens. Which TWO of the following are required under GDPR?
⚠ Common exam trap
CAS-005 often tests whether candidates conflate DPIA requirements with DPO appointment or DPA consultation, so picking 'appoint a DPO' or 'obtain DPA approval' reflects a misunderstanding of when those obligations actually trigger.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Describe the processing operations and purposes
Under GDPR Article 35, a Data Protection Impact Assessment (DPIA) must contain a systematic description of the envisaged processing operations and the purposes of the processing, which is exactly what option D requires, so D is correct. Article 35(7)(b) also mandates an assessment of the necessity and proportionality of the processing operations in relation to their purposes, making option E correct. Option A is wrong because GDPR does not generally require prior DPA approval before processing; prior consultation under Article 36 is only needed when a DPIA indicates high residual risk that cannot be mitigated. Option B is wrong because a DPO is mandatory only under Article 37 conditions (large-scale regular monitoring, large-scale special-category data, or public authority), not for every PIA. Option C is wrong because GDPR does not require publishing the DPIA on a website; the DPIA is documented and made available to the supervisory authority on request.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Obtain approval from a data protection authority before processing
Why it's wrong here
GDPR requires prior consultation with the supervisory authority only when a DPIA shows the processing would result in a high residual risk that cannot be mitigated; routine PIAs proceed without approval. It is tempting because authorities do oversee PIAs, but Article 36 consultation is the exception, not the rule.
- ✗
Appoint a data protection officer (DPO)
Why it's wrong here
A DPO is mandatory only for public authorities, large-scale regular monitoring, or large-scale special-category processing; a small business's routine PIA rarely triggers this. It is tempting because the DPO is the visible GDPR role, but Article 35 requires the DPIA itself, not a DPO appointment.
- ✗
Publish the PIA on the company website
Why it's wrong here
The DPIA is an internal accountability record; GDPR requires it to be documented and made available to the supervisory authority on request, not published publicly. Publication is tempting as a transparency gesture, but Articles 35 and 36 set documentation and consultation duties instead.
- ✓
Describe the processing operations and purposes
Why this is correct
Article 35(7)(a) of GDPR requires the data protection impact assessment to contain a systematic description of the processing operations and the purposes of the processing. This is a mandatory DPIA content element, so describing operations and purposes satisfies that requirement.
- ✓
Assess the necessity and proportionality of the processing
Why this is correct
Article 35(7)(b) of GDPR requires an assessment of the necessity and proportionality of the processing operations in relation to their purposes. This is a mandatory DPIA content element, so assessing necessity and proportionality satisfies that requirement.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CAS-005 question from scratch — 973 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CompTIA exam blueprint
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.