mediumMultiple SelectObjective-mapped
CCSP Practice Question: Which THREE of the following are key components…
Which THREE of the following are key components of a data protection impact assessment (DPIA) under GDPR?
⚠ Common exam trap
ISC2 often tests the misconception that a DPIA is a technical audit checklist requiring detailed cryptographic or personal data inventories, when in fact it is a risk management document focused on necessity, proportionality, and risk mitigation measures.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Measures to address risks
Article 35 of the GDPR explicitly requires a DPIA to include 'measures envisaged to address the risks, including safeguards, security measures and mechanisms to ensure the protection of personal data.' This is a core component that demonstrates how the controller will mitigate identified privacy risks to an acceptable level.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
List of all data subjects' names
Why it's wrong here
A DPIA does not require a list of all data subjects; it focuses on processing activities.
- ✗
Copy of the encryption algorithm
Why it's wrong here
Encryption algorithms are technical details, not a component of a DPIA.
- ✓
Measures to address risks
Why this is correct
Correct. The DPIA must describe measures to mitigate identified risks.
- ✓
Description of processing operations
Why this is correct
Correct. A DPIA must describe the nature, scope, context, and purposes of processing.
- ✓
Assessment of necessity and proportionality
Why this is correct
Correct. The DPIA must assess whether processing is necessary and proportionate.
Go deeper
Related to this question
About these practice questions
This CCSP question is part of Courseiva's 964-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.