Privacy Governance practice questions

Ad-hoc committee based on project needs.

Why wrong: Ad-hoc lacks the consistency needed for governance.

Outsourcing all privacy functions.

Why wrong: Governance accountability cannot be fully outsourced.

Centralized command-and-control structure.

Why wrong: This creates bottlenecks in decentralized firms.

The list of current vendors.

Why wrong: Vendor assessment is a later operational step.

The software inventory.

Why wrong: Software is an asset, not a governing document.

The technical architecture diagram.

Why wrong: Governance precedes technical design.

Creating data erasure requests.

Why wrong: This is part of the 'Protect' function.

Detecting privacy breaches.

Why wrong: This is under the 'Detect' function.

Implementing technical access controls.

Why wrong: This is a Control/Protect function activity.

Archiving personal data.

Why wrong: This is part of the 'Data Lifecycle' management.

The individual data subjects.

Why wrong: Data subjects have rights, not governance responsibilities.

The Lead Supervisory Authority.

Why wrong: The authority is the regulator, not the entity responsible for governance.

The Network Infrastructure team.

Why wrong: This is an internal technical role, not the accountability owner.

The Cloud Service Provider (CSP).

Why wrong: The CSP is a processor; the client is the controller.

Count of privacy training sessions completed.

Why wrong: Output metrics do not measure business value.

Total spend on privacy software tools.

Why wrong: Spending is a cost, not a value indicator.

Number of privacy patches applied.

Why wrong: This is a technical, not a governance, metric.

Conducting periodic penetration tests.

Why wrong: Pen tests address security, not privacy accountability.

Updating the external privacy policy annually.

Why wrong: Policies do not prove operational processing compliance.

Signing NDAs with all employees.

Why wrong: NDAs are administrative, not a ROPA substitute.

Lack of translation services.

Why wrong: Translation is a minor administrative task.

Difficulty in choosing a document management system.

Why wrong: Technical storage is not a governance hurdle.

Inability to find a privacy officer for every region.

Why wrong: Roles can be consolidated or outsourced.

Resistance from the Marketing department.

Why wrong: Internal resistance is manageable via training.

Installing a firewall after code completion.

Why wrong: This is a security, not privacy, requirement integration.

Reviewing audit logs after the system launch.

Why wrong: This is a reactive control, not privacy by design.

Performing a DPIA after production deployment.

Why wrong: DPIAs must be performed before processing.

Approving all business marketing budgets.

Why wrong: DPOs do not have financial approval authority.

Managing the IT server infrastructure.

Why wrong: This is an IT role, not a DPO role.

Developing all corporate software applications.

Why wrong: DPOs are not developers.

Only the Human Resources team.

Why wrong: HR handles employee data but not all privacy risks.

External consultants only.

Why wrong: Internal leaders are needed for cultural change.

Only the IT staff.

Why wrong: Privacy is a business-wide issue, not just IT.

Checking for the presence of a Privacy Impact Assessment template.

Why wrong: The existence of a template does not indicate effective use or maturity.

Reviewing the number of cookies on the public website.

Why wrong: This is a technical check, not a program maturity assessment.

Asking employees if they like the privacy policy.

Why wrong: Subjective opinion is not a measure of maturity.

An email thread.

Why wrong: Emails are informal and unreliable as an audit record.

A standard operating procedure (SOP).

Why wrong: SOPs are for processes, not for recording decisions.

The company's mission statement.

Why wrong: This is high-level vision, not a governance record.

Total replacement of the IT department.

Why wrong: This is incorrect; IT remains necessary.

Elimination of IT costs.

Why wrong: Privacy adds cost, not eliminates it.

Simplification of external legal audits.

Why wrong: Audits are still complex; this is a minor benefit compared to operational efficiency.

Requiring a full DPIA before every sprint.

Why wrong: This would stall agile development; a phased approach is better.

Waiting for the security sign-off at the end of the project.

Why wrong: This violates the principle of privacy by design.

Hard-coding privacy requirements in the source code.

Why wrong: Privacy is about process and policy, not just hard-coded logic.

Ignore the privacy principle.

Why wrong: Ignoring privacy leads to non-compliance.

Ask the CEO to override the privacy policy.

Why wrong: Policies should not be arbitrarily overridden without formal risk review.

Immediately terminate the project.

Why wrong: Termination is an extreme step before evaluating risk.

To satisfy customer requests for free gifts.

Why wrong: This is unrelated to privacy governance.

To save costs on hardware maintenance.

Why wrong: Cost is a secondary benefit, not the primary privacy goal.

To increase storage space.

Why wrong: Retention is about risk, not storage capacity.

A firewall configuration report.

Why wrong: This is a security tool.

A customer feedback survey.

Why wrong: This is an external validation, not a design governance tool.

A list of employee names.

Why wrong: This is unrelated to design defaults.

To calculate the financial costs of IT staff.

Why wrong: PIAs focus on privacy risk, not IT payroll.

To increase the speed of product deployment.

Why wrong: PIAs may slow down deployment to ensure safety.

To fulfill a mandatory public relations requirement.

Why wrong: PIAs are operational, not just PR tools.

An annual policy review conducted by the legal team.

Why wrong: This is a standard, medium-maturity process.

A static document published on the corporate intranet.

Why wrong: This is a basic, low-maturity approach.

A policy signed by all employees once every five years.

Why wrong: This is a low-maturity, neglected process.

Hiring the vendor based solely on price.

Why wrong: Price-only procurement ignores significant privacy risk.

Waiting until the contract is signed before asking for privacy details.

Why wrong: This is too late; you have lost bargaining power.

Allowing the vendor to provide their own privacy policy.

Why wrong: Their policy may not meet your organizational standards.