mediumMultiple ChoiceObjective-mapped
CISSP Practice Question: A multinational corporation is expanding its…
A multinational corporation is expanding its operations into a new country with strict data protection laws. The company needs to ensure compliance while maintaining operational efficiency. Which of the following is the BEST approach to manage this risk?
⚠ Common exam trap
A common mix-up: candidates choose Option B (one-time compliance checklist) because it seems practical and legally focused, but they overlook that privacy compliance is an ongoing process requiring continuous risk assessment and adaptation, not a single review event.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Adopt a privacy-by-design framework and conduct a Data Protection Impact Assessment (DPIA) before launching operations.
A privacy-by-design framework ensures data protection is embedded into systems and processes from the outset, while a Data Protection Impact Assessment (DPIA) systematically identifies and mitigates privacy risks specific to the new jurisdiction. This proactive, risk-based approach aligns with regulatory requirements like the GDPR and demonstrates due diligence, reducing the likelihood of non-compliance and operational disruption.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Accept the risk of non-compliance as a cost of doing business and set aside a contingency fund for fines.
Why it's wrong here
Willfully accepting non-compliance is an unacceptable strategy for a multinational corporation. Beyond monetary fines, which can be substantial and recurring, such an approach exposes the organization to severe legal liabilities, including criminal charges in some jurisdictions, and significant reputational damage. This can lead to loss of customer trust, market share, and even operational restrictions or bans, far outweighing any perceived "cost of doing business."
- ✗
Assign legal counsel to review local laws and implement a one-time compliance checklist.
Why it's wrong here
Relying solely on a one-time legal review and a static compliance checklist is fundamentally inadequate for managing privacy in a dynamic global environment. Privacy regulations are constantly evolving, requiring continuous monitoring and adaptation of policies and controls. Furthermore, effective compliance necessitates the integration of technical safeguards and operational processes, not just a periodic legal assessment, to ensure ongoing adherence to data protection principles.
- ✗
Create a uniform global privacy policy that satisfies all jurisdictions with minimal adjustments.
Why it's wrong here
Attempting to implement a single, uniform global privacy policy with minimal adjustments is highly impractical and risks non-compliance across diverse jurisdictions. Privacy laws, such as GDPR, CCPA, and various national data protection acts, have significant differences in their scope, definitions, consent requirements, data subject rights, and enforcement mechanisms. A "lowest common denominator" approach will almost certainly fail to meet the stringent requirements of more protective regimes, leading to legal exposure.
- ✓
Adopt a privacy-by-design framework and conduct a Data Protection Impact Assessment (DPIA) before launching operations.
Why this is correct
Adopting a privacy-by-design framework ensures that privacy and data protection are proactively embedded into the design and architecture of systems and business practices from the outset, rather than being an afterthought. Conducting a Data Protection Impact Assessment (DPIA) before launching operations is crucial for identifying, assessing, and mitigating privacy risks associated with new data processing activities. This proactive approach is essential for achieving and demonstrating compliance with stringent global privacy regulations.
Go deeper
Related to this question
Learn chapter
Asset Security: Privacy and Data Retention
Key term
Data protection
Data protection refers to the practices and technologies used to safeguard personal and sensitive information from unauthorized access, loss, or corruption.
Key term
Privacy
Privacy in IT is the control over how personal data is collected, stored, used, and shared by systems and organizations.
About these practice questions
One of 747 original CISSP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.