Scenario practice questions

A privacy engineer is working with a data science team that wants to use a production customer database for developing a churn prediction model. The database contains names, email addresses, and purchase histories. The team proposes to replace names and email addresses with random identifiers and store the mapping in a separate table. Which privacy engineering technique is being applied?

Trap 1: Anonymization

Anonymization irreversibly removes the ability to re-identify individuals. In this scenario, the mapping table is retained separately, so re-identification remains possible. Therefore, the data is not anonymized. Anonymization would require destroying the mapping and ensuring no other data can be used to single out individuals, which is not the case here.

Trap 2: Data masking

Data masking typically involves obfuscating data in a non-production environment, often irreversibly, but it does not necessarily preserve a mapping for re-identification. The scenario explicitly retains a mapping table, which is characteristic of pseudonymization, not masking. Masking might be used for test data, but here the goal is to enable analysis with the option to re-identify.

Trap 3: Tokenization

Tokenization replaces sensitive data with tokens that have no intrinsic meaning, and the mapping is stored in a token vault. While similar, tokenization is often used for payment card data and may not involve a separate mapping table managed by the data team. The scenario describes a simple mapping table, which is more indicative of pseudonymization than tokenization.

A
Anonymization
Why it fails: Anonymization irreversibly removes the ability to re-identify individuals. In this scenario, the mapping table is retained separately, so re-identification remains possible. Therefore, the data is not anonymized. Anonymization would require destroying the mapping and ensuring no other data can be used to single out individuals, which is not the case here.
B
Data masking
Why it fails: Data masking typically involves obfuscating data in a non-production environment, often irreversibly, but it does not necessarily preserve a mapping for re-identification. The scenario explicitly retains a mapping table, which is characteristic of pseudonymization, not masking. Masking might be used for test data, but here the goal is to enable analysis with the option to re-identify.
C
Tokenization
Why it fails: Tokenization replaces sensitive data with tokens that have no intrinsic meaning, and the mapping is stored in a token vault. While similar, tokenization is often used for payment card data and may not involve a separate mapping table managed by the data team. The scenario describes a simple mapping table, which is more indicative of pseudonymization than tokenization.
D
Pseudonymization
Pseudonymization replaces direct identifiers with artificial identifiers, and the mapping table allows re-identification. This aligns with the scenario where names and emails are replaced by random IDs and the mapping is kept separately. It reduces privacy risk while preserving data utility for model development, and is explicitly recognized as a privacy-enhancing technique under regulations such as the GDPR.

Question 2mediummultiple choice

To prevent 're-identification' of an anonymized dataset, what process should be applied if the dataset is merged with external public data?

Trap 1: Data validation

Validation checks format, type and range conformance, not whether quasi-identifiers in the merged set uniquely single out individuals, so linkage re-identification proceeds unchecked. It is tempting because validation is a real data-quality step before merging, and would be correct when the goal is detecting malformed or inconsistent records.

Trap 2: Backup encryption

Backup encryption protects stored copies from unauthorised disclosure; it does nothing to the statistical uniqueness of records once the anonymised set is joined to public data, so re-identification via linkage still succeeds. It is tempting because encryption is a genuine data-protection control, and would be right for securing backup media at rest.

Trap 3: Database normalization

This improves performance.

A
Data validation
Why it fails: Validation checks format, type and range conformance, not whether quasi-identifiers in the merged set uniquely single out individuals, so linkage re-identification proceeds unchecked. It is tempting because validation is a real data-quality step before merging, and would be correct when the goal is detecting malformed or inconsistent records.
B
Backup encryption
Why it fails: Backup encryption protects stored copies from unauthorised disclosure; it does nothing to the statistical uniqueness of records once the anonymised set is joined to public data, so re-identification via linkage still succeeds. It is tempting because encryption is a genuine data-protection control, and would be right for securing backup media at rest.
C
Database normalization
Why it fails: This improves performance.
D
Linkage attack analysis
Linkage attack analysis tests whether the anonymised dataset, when joined with external public sources, allows individuals to be singled out or re-identified through quasi-identifier combinations. It identifies which attributes must be generalised, suppressed or perturbed before release.

Question 3mediummultiple choice

A global retailer is expanding into new markets and needs a holistic view of how personal data moves across its subsidiaries and third parties. The Chief Privacy Officer wants a single, visual representation that maps data flows, identifies cross-border transfers, and highlights potential risk points. Which privacy governance tool should be used to achieve this?

Trap 1: Data protection impact assessment (DPIA)

A DPIA is a process for identifying and mitigating risks in a specific project or system, not for creating an enterprise-wide visual map of data flows. It is triggered by high-risk processing and produces a report, but it does not provide the holistic, cross-border view that the CPO needs to govern data movement across subsidiaries and third parties.

Trap 2: Privacy maturity assessment

A privacy maturity assessment evaluates the organization's privacy program against a model, highlighting strengths and gaps. It does not produce a visual map of data flows or identify specific risk points in data movement. While useful for strategic planning, it does not fulfill the CPO's immediate need for a holistic view of cross-border transfers and third-party data handling.

Trap 3: Record of processing activities (ROPA)

A ROPA is a structured inventory of processing activities, required by regulations like the GDPR, but it is typically a textual or tabular record. While it contains details such as purposes and categories, it does not inherently provide a visual, interconnected map that highlights risk points and cross-border data flows across the entire organization.

A
Data protection impact assessment (DPIA)
Why it fails: A DPIA is a process for identifying and mitigating risks in a specific project or system, not for creating an enterprise-wide visual map of data flows. It is triggered by high-risk processing and produces a report, but it does not provide the holistic, cross-border view that the CPO needs to govern data movement across subsidiaries and third parties.
B
Privacy maturity assessment
Why it fails: A privacy maturity assessment evaluates the organization's privacy program against a model, highlighting strengths and gaps. It does not produce a visual map of data flows or identify specific risk points in data movement. While useful for strategic planning, it does not fulfill the CPO's immediate need for a holistic view of cross-border transfers and third-party data handling.
C
Record of processing activities (ROPA)
Why it fails: A ROPA is a structured inventory of processing activities, required by regulations like the GDPR, but it is typically a textual or tabular record. While it contains details such as purposes and categories, it does not inherently provide a visual, interconnected map that highlights risk points and cross-border data flows across the entire organization.
D
Data flow mapping
Data flow mapping is a governance technique that visually depicts how personal data moves through systems, departments, and jurisdictions. It reveals cross-border transfers, third-party dependencies, and potential risk points, giving the CPO the holistic view needed to oversee privacy across subsidiaries and vendors. It is the appropriate tool for this scenario because it directly addresses the need for a visual representation of data movement.

Question 4hardmultiple choice

A CDPSE is conducting a privacy risk assessment for a new cloud-based human resources (HR) system that will process employee personal data, including performance evaluations, disciplinary records, and health information for benefits administration. The system is hosted by a third-party vendor in a different jurisdiction. The CDPSE must identify the MOST significant privacy risk associated with this arrangement. Which of the following is the MOST critical risk to address?

Trap 1: The vendor may use employee data for its own marketing purposes…

Unauthorized use by the vendor is a serious concern, but it is typically addressed through contractual clauses and vendor oversight. In the context of a cross-border transfer, the lack of a legal transfer mechanism is a more fundamental risk because it makes the transfer itself unlawful, regardless of the vendor's actions. Contractual protections are important but secondary to establishing a lawful basis for the transfer. Thus, this option, while valid, is not the most critical.

Trap 2: The HR system may not provide employees with the ability to access…

Data subject rights are essential, but the inability to exercise them is a compliance gap that can be remedied through system configuration and contractual requirements. The more critical risk is the unlawful cross-border transfer, which could invalidate the entire processing activity and lead to severe penalties. While access and correction rights must be supported, they are not the primary risk when data is transferred to a different jurisdiction without a valid mechanism. Therefore, this option is not the most critical.

Trap 3: The vendor may not have sufficient technical security controls to…

While security controls are important, the most significant privacy risk in this scenario is not solely technical. The cross-border nature of the arrangement introduces legal and compliance risks that can render the entire processing unlawful, regardless of security measures. Technical security is a component, but it does not address the fundamental issue of lawful data transfers and vendor accountability. Therefore, this option, though relevant, is not the most critical risk.

A
The transfer of employee data to a different jurisdiction may lack a valid legal transfer mechanism, such as Standard Contractual Clauses or an adequacy decision.
The most critical risk is the unlawful transfer of personal data across borders. Under GDPR and similar laws, transfers to third countries require a valid legal mechanism, such as an adequacy decision, Standard Contractual Clauses, or Binding Corporate Rules. Without this, the processing is non-compliant and could result in significant fines and regulatory action. This risk supersedes technical security because it goes to the lawfulness of the entire processing operation. The CDPSE must prioritize ensuring a valid transfer mechanism is in place.
B
The vendor may use employee data for its own marketing purposes without authorization.
Why it fails: Unauthorized use by the vendor is a serious concern, but it is typically addressed through contractual clauses and vendor oversight. In the context of a cross-border transfer, the lack of a legal transfer mechanism is a more fundamental risk because it makes the transfer itself unlawful, regardless of the vendor's actions. Contractual protections are important but secondary to establishing a lawful basis for the transfer. Thus, this option, while valid, is not the most critical.
C
The HR system may not provide employees with the ability to access and correct their personal data.
Why it fails: Data subject rights are essential, but the inability to exercise them is a compliance gap that can be remedied through system configuration and contractual requirements. The more critical risk is the unlawful cross-border transfer, which could invalidate the entire processing activity and lead to severe penalties. While access and correction rights must be supported, they are not the primary risk when data is transferred to a different jurisdiction without a valid mechanism. Therefore, this option is not the most critical.
D
The vendor may not have sufficient technical security controls to protect data from external hackers.
Why it fails: While security controls are important, the most significant privacy risk in this scenario is not solely technical. The cross-border nature of the arrangement introduces legal and compliance risks that can render the entire processing unlawful, regardless of security measures. Technical security is a component, but it does not address the fundamental issue of lawful data transfers and vendor accountability. Therefore, this option, though relevant, is not the most critical risk.

Question 5hardmultiple choice

A multinational bank is implementing a new AI-driven credit scoring system that processes personal data of EU residents. The CDPSE must ensure the processing complies with GDPR. Which of the following is the MOST appropriate action to take FIRST?

Trap 1: Obtain explicit consent from all data subjects, as automated…

While automated decision-making requires a legal basis, explicit consent is only one option; other bases like contract necessity or legal obligation may apply. GDPR does not mandate explicit consent for all automated decisions. Thus, obtaining consent first is not the most appropriate initial step; a DPIA should come first.

Trap 2: Implement pseudonymization of the data before processing to…

Pseudonymization reduces risk but does not eliminate it, and it is a technical measure, not a first compliance step. GDPR still considers pseudonymized data as personal data. The first step should be assessing the risk through a DPIA, not implementing a specific safeguard.

Trap 3: Appoint a Data Protection Officer (DPO) because any organization…

A DPO is required only under specific conditions (e.g., large-scale monitoring or processing of special categories). Not every AI processing requires a DPO. Appointing a DPO is not the first action to ensure compliance for this specific processing; a DPIA is the targeted requirement.

A
Conduct a Data Protection Impact Assessment (DPIA) because the processing involves systematic and extensive evaluation of personal aspects based on automated processing.
GDPR Article 35 requires a DPIA for processing that uses new technologies and is likely to result in a high risk to data subjects, including systematic and extensive automated profiling. Credit scoring is explicitly listed as an example. Performing a DPIA first identifies and mitigates risks before processing begins.
B
Obtain explicit consent from all data subjects, as automated decision-making always requires explicit consent under GDPR.
Why it fails: While automated decision-making requires a legal basis, explicit consent is only one option; other bases like contract necessity or legal obligation may apply. GDPR does not mandate explicit consent for all automated decisions. Thus, obtaining consent first is not the most appropriate initial step; a DPIA should come first.
C
Implement pseudonymization of the data before processing to eliminate privacy risks.
Why it fails: Pseudonymization reduces risk but does not eliminate it, and it is a technical measure, not a first compliance step. GDPR still considers pseudonymized data as personal data. The first step should be assessing the risk through a DPIA, not implementing a specific safeguard.
D
Appoint a Data Protection Officer (DPO) because any organization using AI must have a DPO.
Why it fails: A DPO is required only under specific conditions (e.g., large-scale monitoring or processing of special categories). Not every AI processing requires a DPO. Appointing a DPO is not the first action to ensure compliance for this specific processing; a DPIA is the targeted requirement.

Question 6easymultiple choice

A privacy engineer is reviewing a new mobile application that collects location data. The app currently requests access to the device's precise location every time it is opened, even when the user is not actively using the app. Which privacy engineering principle is being violated?

Trap 1: Integrity and confidentiality

Integrity and confidentiality require protecting personal data against unauthorized or unlawful processing and accidental loss, destruction, or damage. The scenario does not indicate a security breach or inadequate protection. The concern is about over-collection, not the security measures applied to the data.

Trap 2: Storage limitation

Storage limitation requires that personal data be kept only as long as necessary for the purposes for which it is processed. The scenario does not mention how long the location data is stored, so this principle is not directly violated. The issue is with the collection frequency and precision, not retention duration.

Trap 3: Purpose limitation

Purpose limitation means data should be collected for specified, explicit, and legitimate purposes and not further processed in a manner incompatible with those purposes. While related, the scenario primarily describes excessive collection rather than processing for an incompatible purpose. The app's purpose might be legitimate, but the amount and timing of collection are not minimized.

A
Integrity and confidentiality
Why it fails: Integrity and confidentiality require protecting personal data against unauthorized or unlawful processing and accidental loss, destruction, or damage. The scenario does not indicate a security breach or inadequate protection. The concern is about over-collection, not the security measures applied to the data.
B
Storage limitation
Why it fails: Storage limitation requires that personal data be kept only as long as necessary for the purposes for which it is processed. The scenario does not mention how long the location data is stored, so this principle is not directly violated. The issue is with the collection frequency and precision, not retention duration.
C
Purpose limitation
Why it fails: Purpose limitation means data should be collected for specified, explicit, and legitimate purposes and not further processed in a manner incompatible with those purposes. While related, the scenario primarily describes excessive collection rather than processing for an incompatible purpose. The app's purpose might be legitimate, but the amount and timing of collection are not minimized.
D
Data minimization
Data minimization requires collecting only the personal data that is necessary for the specified purpose. Requesting precise location when the app is not in use is excessive and unnecessary, violating this principle. The app should limit collection to what is needed for its functionality and only during active use, unless a legitimate background purpose exists and is clearly communicated.

Question 7mediummulti select

A privacy analyst is reviewing the data life cycle for a cloud-based HR system that processes employee personal data. The organization must ensure that data minimization is applied during the collection and storage phases. Which two practices should the analyst recommend to achieve data minimization in this scenario? (Choose two.)

Trap 1: Implement field-level encryption for all employee data stored in…

Field-level encryption protects data confidentiality but does not reduce the amount of data collected or stored. The same fields are still present, just encrypted. Encryption is a security control, not a minimization technique. It does not address the principle of limiting data to what is necessary, so it fails to achieve the required minimization.

Trap 2: Configure automatic deletion of employee records 30 days after…

Automatic deletion after termination is a retention control, not a minimization practice during collection or storage. It reduces data over time but does not limit the initial collection or the fields stored while employed. Data minimization focuses on limiting the amount and types of data collected and retained for the active purpose, not solely on end-of-life disposal.

Trap 3: Use pseudonymization to replace employee names with artificial…

Pseudonymization reduces identifiability but does not minimize the amount of data. The same fields are still collected and stored; only the identifiers are changed. It is a privacy-enhancing technique, but not a data minimization method, because it does not reduce the volume or scope of personal data processed.

A
Collect only the employee data fields that are strictly necessary for payroll and benefits administration.
Collecting only necessary fields directly implements data minimization at the point of collection. By limiting data to what is required for payroll and benefits, the organization reduces the volume of personal data stored and processed, lowering privacy risk and compliance scope. This practice aligns with the principle of data minimization in privacy regulations.
B
Implement field-level encryption for all employee data stored in the HR system.
Why it fails: Field-level encryption protects data confidentiality but does not reduce the amount of data collected or stored. The same fields are still present, just encrypted. Encryption is a security control, not a minimization technique. It does not address the principle of limiting data to what is necessary, so it fails to achieve the required minimization.
C
Regularly review stored employee data and purge fields that are no longer needed for the original purpose.
Regularly reviewing and purging unnecessary fields ensures that data minimization is maintained throughout the storage phase. Over time, business needs may change, and some data may become redundant. This practice reduces the data footprint and aligns with the principle of limiting data to what is necessary for the ongoing purpose.
D
Configure automatic deletion of employee records 30 days after termination.
Why it fails: Automatic deletion after termination is a retention control, not a minimization practice during collection or storage. It reduces data over time but does not limit the initial collection or the fields stored while employed. Data minimization focuses on limiting the amount and types of data collected and retained for the active purpose, not solely on end-of-life disposal.
E
Use pseudonymization to replace employee names with artificial identifiers in the HR system.
Why it fails: Pseudonymization reduces identifiability but does not minimize the amount of data. The same fields are still collected and stored; only the identifiers are changed. It is a privacy-enhancing technique, but not a data minimization method, because it does not reduce the volume or scope of personal data processed.