Privacy Risk Management And Compliance

A multinational company is transferring data between its US and EU subsidiaries. Which mechanism is most effective for ensuring cross-border data transfer compliance after the invalidation of previous frameworks?

An organization's privacy policy is updated to reflect a new vendor. What is the most important follow-up action?

When mapping data flows to identify privacy risks, a practitioner discovers that personal data is being transferred to a non-affiliated third party. What is the immediate requirement?

Which TWO actions should a CDPSE take to demonstrate 'Privacy by Design' in a software project?

When conducting a privacy risk assessment, what is the significance of 'Data Lifecycle Management'?

During a DPIA (Data Protection Impact Assessment), a CDPSE identifies a high risk to data subjects due to the use of AI-driven profiling. What is the appropriate next step?

When a third-party vendor reports a data breach, what is the first step the CDPSE should take?

Which THREE documents are typically required for compliance with global privacy regulations?

During a Data Mapping exercise, the CDPSE discovers that a legacy database stores PII in cleartext. The system is scheduled for decommissioning in 18 months. What is the most appropriate privacy risk mitigation strategy?

An organization is evaluating a cloud service provider (CSP) for storing sensitive customer data. Under the GDPR, what is the most critical step the CDPSE must perform to manage third-party privacy risk?

Which TWO security measures are most effective in protecting against unauthorized access to PII?

A CDPSE practitioner is conducting a Privacy Impact Assessment (PIA) for a new marketing application that uses behavioral tracking. Which action should be prioritized to ensure compliance with privacy-by-design principles?

In the event of a personal data breach, which TWO actions are required to satisfy the notification obligations under many modern privacy regulations (e.g., GDPR)?

Which TWO actions should a CDPSE prioritize when assessing a vendor for privacy compliance?

A company is implementing a new CCPA compliance tool. Which feature should be used to automate the 'Right to Opt-Out' request process for web visitors?

A third-party vendor is providing an API integration for customer support. As a CDPSE, what is the first step you should take in the third-party privacy risk management lifecycle?

Which TWO factors must be considered when determining if a cross-border data transfer is lawful under GDPR?

Which THREE elements are essential in a Data Protection Impact Assessment (DPIA) report?

When managing privacy risks, which TWO approaches help in 'Data Minimization'?

A CDPSE practitioner is conducting a Privacy Impact Assessment (PIA) for a new marketing application. During the data flow mapping phase, they identify that PII is being transferred to a cloud service provider located in a non-equivalent jurisdiction. Which action should the practitioner prioritize to ensure compliance with the GDPR?

Which THREE types of personal data are typically considered 'special category' or 'sensitive' data under privacy regulations?

A company is using an automated system to make credit decisions. What is the main privacy concern regarding the 'Right to Explanation'?

An organization is implementing a 'Privacy by Design' framework for a machine learning model used to predict customer churn. Which technique should be utilized to minimize privacy risk while maintaining model utility?

When establishing a Privacy Risk Assessment methodology, which TWO components are essential to ensure the assessment is repeatable and defensible?

A company is considering the use of a data broker. Which privacy risk is most significant?

What is the first step in creating a data inventory for a privacy program?

During an audit, it is found that an application logs user session tokens including sensitive user IDs. What is the correct privacy recommendation?

How can a CDPSE ensure that personal data is only kept for as long as necessary?

What is the primary purpose of a Data Privacy Impact Assessment (DPIA)?

Your organization is preparing for a CCPA/CPRA audit. You are asked to verify the 'Right to Opt-Out of Sale or Sharing' implementation. Which technical requirement must be validated to ensure compliance with the Global Privacy Control (GPC) signal?

Which THREE activities should be included in an organization's privacy compliance monitoring program to identify potential regulatory non-compliance?

A CDPSE is reviewing a vendor's privacy controls. Which finding would be considered a major non-compliance risk?

A CDPSE is advising on a website redesign. What is the most important privacy-related feature for a contact form?

Which technique should be used to protect personal data during software testing?

A CDPSE is auditing a legacy application that stores passwords in plain text. What is the most effective immediate mitigation strategy?

When evaluating a third-party's security, what should the CDPSE focus on to ensure effective privacy risk management?

A company wants to collect geolocation data from mobile users. Which privacy principle should be applied first?

Which THREE steps are vital when responding to a Data Subject Access Request (DSAR)?

Which of the following is the most critical element to include in a Privacy Notice under GDPR to fulfill the 'Right to be Informed'?

A company is preparing for a CCPA audit. Which internal process is most important to demonstrate compliance regarding the 'Right to Know'?

A company is implementing a Bring Your Own Device (BYOD) policy. What is the primary privacy challenge?

A multinational company is evaluating a SaaS solution. As a CDPSE, you must ensure that the vendor's data retention policy aligns with your organization's internal privacy standards. Where should this requirement be formally documented?

Which document should a CDPSE review to understand the organization's legal basis for processing employee personal data?

What does 'Privacy by Default' imply regarding system configuration?

Which THREE items should be included in a Privacy Policy that aligns with global transparency requirements?