hardMultiple ChoiceObjective-mapped
CISSP Practice Question: A multinational company must comply with the EU…
A multinational company must comply with the EU General Data Protection Regulation (GDPR) for processing personal data of EU citizens. The company's data protection officer (DPO) has been appointed but reports to the Chief Marketing Officer (CMO). Which compliance issue is most critical?
⚠ Common exam trap
The trap here is that candidates often focus on the DPO's qualifications or location (options B and C) because those are commonly discussed in GDPR training, but the most critical issue is the DPO's independence and reporting line, which directly impacts their ability to enforce compliance without conflict of interest.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The DPO must report directly to the board of directors or CEO
Under the GDPR, the Data Protection Officer (DPO) must report directly to the highest level of management, typically the board of directors or CEO, to ensure independence and authority. Reporting to the Chief Marketing Officer (CMO) creates a conflict of interest because the CMO oversees marketing activities that often involve extensive personal data processing, compromising the DPO's ability to provide unbiased oversight. This structural subordination is the most critical compliance issue as it directly undermines the DPO's statutory role under Article 38(3) of the GDPR.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The DPO should not hold any other role within the organization
Why it's wrong here
GDPR Article 38(6) states that a Data Protection Officer (DPO) may fulfill other tasks and duties, provided these do not result in a conflict of interest. This means the DPO can hold dual roles, as long as their additional responsibilities do not involve determining the purposes and means of processing personal data, which would compromise their ability to independently advise and monitor compliance. The key is avoiding situations where the DPO would be auditing their own decisions.
- ✗
The DPO must be a lawyer certified in data protection
Why it's wrong here
GDPR Article 37(5) requires the DPO to possess 'expert knowledge of data protection law and practices,' but it does not mandate a specific professional certification or a legal background. While legal expertise is valuable, the role also demands understanding of information technology, security, and organizational processes. Therefore, a DPO does not strictly need to be a certified lawyer, as long as they demonstrate the requisite knowledge and experience for the role.
- ✗
The DPO must be located in the EU
Why it's wrong here
GDPR does not explicitly require the Data Protection Officer to be physically located within the European Union. Article 37(6) allows the DPO to be an employee of the controller or processor, or to fulfill the tasks on the basis of a service contract, without specifying a geographical residency. The crucial requirement is that the DPO must be 'easily accessible' from within the EU by data subjects and supervisory authorities, which can be achieved remotely.
- ✓
The DPO must report directly to the board of directors or CEO
Why this is correct
GDPR Article 38(3) explicitly mandates that the Data Protection Officer (DPO) must directly report to the highest management level of the controller or processor. This direct reporting line, typically to the board of directors or CEO, is fundamental to ensuring the DPO's independence and authority within the organization. It enables the DPO to perform their duties without undue influence and ensures their recommendations on data protection are given due consideration by strategic decision-makers.
Go deeper
Related to this question
Learn chapter
Asset Security: Privacy and Data Retention
Key term
GDPR
The General Data Protection Regulation (GDPR) is a European Union law that sets strict rules for how organizations collect, store, process, and protect the personal data of individuals within the EU.
Key term
Compliance
Compliance is the process of ensuring that an organization follows laws, regulations, standards, and internal policies that apply to its operations and data handling.
About these practice questions
This CISSP question is part of Courseiva's 747-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.