easyMultiple ChoiceObjective-mapped
CISSP Practice Question: A small business wants to ensure compliance with…
A small business wants to ensure compliance with GDPR for its customer data. What is the initial action required to comply with GDPR?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Map data flows and identify personal data
Before implementing controls or appointing a DPO, the organization must first understand what data it processes and where it flows. Mapping data flows and identifying personal data is the foundational step for all subsequent compliance activities.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Obtain consent from all data subjects
Why it's wrong here
Obtaining consent from data subjects, while a valid legal basis under GDPR, is not the initial step for compliance. Informed consent requires the data subject to understand precisely what personal data is being collected, for what specific purposes, and how it will be processed. Without first mapping data flows and identifying the personal data an organization holds, it is impossible to provide the necessary transparency for valid consent.
- ✗
Implement pseudonymization techniques
Why it's wrong here
Implementing pseudonymization techniques is a technical and organizational measure designed to enhance data protection by reducing the linkability of personal data to a data subject. However, this control is applied *after* the organization has identified what personal data it processes and understands its purpose and risks. It is a method of risk mitigation, not a foundational step for discovering the scope of personal data processing activities.
- ✗
Conduct a Data Protection Impact Assessment (DPIA)
Why it's wrong here
Conducting a Data Protection Impact Assessment (DPIA) is a specific requirement under GDPR Article 35 for processing operations that are *likely to result in a high risk* to the rights and freedoms of individuals. Before an organization can determine if a DPIA is necessary, or what risks to assess, it must first have a comprehensive understanding of the personal data it processes, the nature of the processing, and its context. Therefore, a DPIA is a subsequent risk management step, not the initial discovery phase.
- ✓
Map data flows and identify personal data
Why this is correct
Mapping data flows and identifying personal data is the crucial foundational step for any GDPR compliance program. This process involves creating a comprehensive inventory of all personal data an organization collects, processes, stores, and shares, including its origin, destination, purpose, and legal basis. This initial understanding of the data landscape is essential for assessing risks, implementing appropriate safeguards, and demonstrating accountability under GDPR.
Go deeper
Related to this question
Learn chapter
Asset Security: Privacy and Data Retention
Key term
Compliance
Compliance is the process of ensuring that an organization follows laws, regulations, standards, and internal policies that apply to its operations and data handling.
Key term
GDPR
The General Data Protection Regulation (GDPR) is a European Union law that sets strict rules for how organizations collect, store, process, and protect the personal data of individuals within the EU.
About these practice questions
Courseiva writes every CISSP question from scratch — 747 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.