I85PREP
⌘ K
CIPM study materials
CIPM study resources

CIPM practice questions

One question at a time. Build your CIPM understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Develop a Privacy Strategy

Which description best captures the role of a privacy strategy, as distinct from a privacy compliance program?

  1. It sets long-term direction and connects privacy to business goals. Correct answer.
  2. It defines the steps for answering individual data subject requests.
  3. It specifies the security controls used to protect personal data.
  4. It catalogs the privacy laws that apply in each jurisdiction.

Explanation

A privacy strategy defines where the program is going and why, aligning privacy with enterprise objectives and risk appetite. Compliance activities execute against specific legal requirements and operational procedures.

Question 2Develop a Privacy Strategy

Where should ultimate ownership of an organization's privacy strategy typically sit?

  1. With the privacy office alone, because it holds privacy expertise.
  2. With the information security team, because it controls data safeguards.
  3. With outside counsel, because privacy obligations are legal requirements.
  4. With executive leadership and the board, advised by privacy. Correct answer.

Explanation

Ultimate accountability for privacy strategy rests with the board and executive leadership, who set risk appetite and allocate resources. The privacy office advises and operates the program but does not replace enterprise ownership.

Question 3Develop a Privacy Strategy

Which strategic practice best reflects the privacy-by-design principle of being proactive rather than reactive?

  1. Conducting a data protection impact assessment after a product launch.
  2. Embedding privacy into product design and approval gates. Correct answer.
  3. Updating the privacy notice after new data uses are introduced.
  4. Responding to regulator inquiries within the required deadlines.

Explanation

Privacy by design calls for anticipating privacy issues and building safeguards into products and processes before they launch. Post-launch assessments, notice updates, and inquiry responses are corrective or reactive activities.

Question 4Develop a Privacy Strategy

Why should business unit leaders be involved early in privacy strategy development?

  1. They can approve the privacy budget without executive review.
  2. They align privacy with operational realities and build ownership. Correct answer.
  3. They can decide which laws the organization will follow.
  4. They can replace the need for a dedicated privacy office.

Explanation

Early business involvement grounds the strategy in how work is actually performed and increases commitment to implementation. It does not transfer legal judgment or eliminate the need for privacy expertise.

Question 5Develop a Privacy Strategy

Which measure is best classified as a leading indicator of privacy program effectiveness?

  1. Number of data breaches reported to regulators last quarter
  2. On-time completion of role-based privacy training Correct answer.
  3. Total cost of privacy litigation concluded last year
  4. Number of privacy fines received in the past year

Explanation

Leading indicators measure preventive activities that influence future outcomes, such as whether employees are trained for their roles. Fines, breaches, and litigation costs are lagging outcomes that occur after risk events.

Question 6Develop a Privacy Strategy

What is the primary purpose of a privacy vision statement?

  1. To assign operational tasks to privacy team members
  2. To list the specific controls required by applicable privacy laws
  3. To describe the desired future state and guide decisions Correct answer.
  4. To document the organization's data retention schedules

Explanation

A vision statement articulates the desired future state and provides a stable reference for strategic choices. Controls, task assignments, and retention schedules are operational artifacts rather than vision statements.

Question 7Develop a Privacy Strategy

Which reporting arrangement best supports the independence of a data protection officer (DPO)?

  1. The DPO reports to the IT service desk and manages endpoint security.
  2. The DPO reports to the chief marketing officer and leads demand generation.
  3. The DPO reports to top management without conflicting duties Correct answer.
  4. The DPO reports to the sales director and approves customer contracts.

Explanation

DPO independence is supported when the role reports to the highest management level and is not given duties that create conflicts with privacy oversight. Marketing, IT operations, and sales responsibilities can compromise objective privacy judgment.

Question 8Develop a Privacy Strategy

What is the main function of a privacy roadmap?

  1. To replace the privacy policy with a detailed technical standard
  2. To sequence initiatives toward the target state Correct answer.
  3. To record the outcome of every privacy incident investigation
  4. To list every employee who has access to personal data

Explanation

A roadmap translates strategy into a sequenced set of initiatives, milestones, and dependencies that move the program from its current state to its target state. It is a planning tool rather than a policy, incident log, or access inventory.

Question 9Develop a Privacy Strategy

A gap assessment finds that most business units have incomplete records of processing activities. What is the most appropriate first strategic action?

  1. Prioritize remediation by risk, with owners and target dates. Correct answer.
  2. Wait for the next regulatory examination before acting.
  3. Delegate the entire remediation to a single junior analyst.
  4. Suspend all processing until every record is completed.

Explanation

Remediation should be risk-based, resourced, and tracked so that the most consequential gaps are addressed first. Halting all processing is disproportionate, and waiting for an examination creates avoidable exposure.

Question 10Develop a Privacy Strategy

What role does a defined privacy risk appetite play in privacy strategy?

  1. It eliminates the need for privacy impact assessments.
  2. It guarantees that no privacy incidents will occur.
  3. It replaces legal requirements with internal preferences.
  4. It defines acceptable privacy risk and guides prioritization. Correct answer.

Explanation

Risk appetite states how much privacy risk the organization is willing to accept in pursuit of its objectives and informs decisions about treatment and priority. It does not override legal obligations, eliminate assessments, or guarantee outcomes.

Question 11Develop a Privacy Strategy

How is a privacy maturity model most useful to a privacy strategist?

  1. It removes the need for stakeholder input during strategy development.
  2. It benchmarks practices against defined levels and guides improvements. Correct answer.
  3. It provides a fixed budget template for privacy spending.
  4. It certifies that the organization is compliant with every privacy law.

Explanation

Maturity models provide structured levels against which current practices can be assessed, helping leaders identify gaps and plan improvements. They are diagnostic and planning tools, not legal certifications or substitutes for stakeholder engagement.

Question 12Develop a Privacy Strategy

A multinational company has diverse business units with different data uses. Which privacy operating model is generally most effective?

  1. A hybrid model with central standards and business-unit execution. Correct answer.
  2. A fully decentralized model in which each unit sets its own privacy rules.
  3. A single centralized team that approves every operational privacy decision.
  4. An outsourced model that removes internal privacy accountability.

Explanation

A hybrid operating model balances consistent enterprise standards with local responsiveness to varied business contexts. Fully decentralized models risk fragmentation, while full centralization can become a bottleneck.

Question 13Develop a Privacy Strategy

Which metric best reflects a strategic privacy outcome rather than operational activity?

  1. Number of privacy policies published on the intranet
  2. Fewer incidents linked to poor product design Correct answer.
  3. Number of privacy training sessions delivered
  4. Count of meetings held by the privacy steering committee

Explanation

Outcome metrics capture changes in risk or performance that matter strategically, such as fewer design-related incidents. Activity metrics count outputs like sessions, policies, and meetings without showing whether risk improved.

Question 14Develop a Privacy Strategy

What should privacy reporting to the board of directors emphasize most?

  1. Names of employees who failed privacy training
  2. Detailed logs of individual data subject requests
  3. Minute-by-minute status of the privacy team's backlog
  4. Strategic privacy risks, trends, and program effectiveness Correct answer.

Explanation

Board reporting should focus on material risks, emerging trends, and whether the program is effective so directors can exercise oversight. Detailed operational logs and individual performance data are better handled at management levels.

Question 15Develop a Privacy Strategy

Which approach best keeps a privacy strategy responsive to a changing regulatory landscape?

  1. Structured horizon scanning with scheduled strategy reviews Correct answer.
  2. Delegating all legal monitoring to business unit managers
  3. Reviewing privacy laws only when a regulator makes an inquiry
  4. Freezing the strategy for five years to ensure consistency

Explanation

Horizon scanning identifies legal and regulatory developments early, and scheduled reviews allow the strategy to adapt before changes take effect. Reactive review or long freezes leave the organization exposed to new obligations.

Question 16Develop a Privacy Strategy

Which set of participants is most appropriate for a cross-functional privacy steering committee?

  1. Leaders from legal, security, product, HR, and business Correct answer.
  2. Only external consultants, auditors, and regulators
  3. Only IT security engineers and data center operators
  4. Only members of the privacy legal team and outside counsel

Explanation

A steering committee needs representation from the functions that create, control, and use personal data so decisions reflect operational and legal realities. A single-function committee lacks the breadth to govern enterprise privacy strategy.

Question 17Develop a Privacy Strategy

When seeking executive approval for privacy investment, which argument is strongest?

  1. It compares privacy spending to competitors' marketing budgets.
  2. It promises that privacy spending will eliminate all breach risk.
  3. It links spending to lower risk and trusted business growth. Correct answer.
  4. It argues that privacy is important because regulators exist.

Explanation

Executives allocate resources based on value and risk, so tying privacy investment to reduced exposure and business trust is compelling. Abstract appeals, irrelevant comparisons, and absolute promises are weak or implausible.

Question 18Develop a Privacy Strategy

What is a sound strategic approach to managing privacy risk from third-party vendors?

  1. Outsource all privacy accountability to the largest vendors.
  2. Apply identical due diligence to every vendor regardless of data use.
  3. Rely on vendor self-attestations without independent review.
  4. Tier vendors by risk and apply proportionate due diligence. Correct answer.

Explanation

Risk tiering directs greater scrutiny to vendors that process sensitive or high-volume data while keeping oversight proportionate for lower-risk relationships. Accountability for regulatory compliance remains with the organization.

Question 19Develop a Privacy Strategy

Which combination is most effective for building a durable privacy culture?

  1. Punitive audits after incidents without preventive training
  2. A one-time awareness campaign at employee onboarding
  3. Leadership modeling, role-based training, and incentives Correct answer.
  4. Annual policy distribution with no leadership involvement

Explanation

Culture is reinforced when leaders visibly model privacy behavior, training is relevant to each role, and incentives reward good practice. One-time or punitive-only approaches do not sustain everyday privacy behavior.

Question 20Develop a Privacy Strategy

What is typically the first step in developing an organization's privacy strategy?

  1. Publishing the external privacy notice on the corporate website
  2. Selecting a privacy technology vendor and negotiating the license terms
  3. Assessing business goals, stakeholder needs, and current state Correct answer.
  4. Drafting the annual privacy budget and allocating headcount

Explanation

Strategy begins with understanding the business context, stakeholder expectations, and the current privacy posture so that priorities and target states are grounded in reality. Vendor selection, budgeting, and notices follow from strategic choices.

Question 21Develop a Privacy Strategy

When evaluating privacy-enhancing technologies (PETs) for strategic adoption, what is the most important criterion?

  1. Fit with risk profile and a validated business use case Correct answer.
  2. Speed of deployment without regard to operational impact
  3. Number of features listed in the vendor's sales brochure
  4. Novelty of the underlying cryptographic research

Explanation

PETs create value when they address a defined privacy risk in a way that fits the organization's risk appetite and operations. Novelty, marketing feature counts, and speed alone do not establish strategic fit.

Question 22Develop a Privacy Strategy

How does the accountability principle differ from a narrow compliance approach?

  1. It requires proactive responsibility and demonstrable compliance Correct answer.
  2. It requires only reacting to regulator investigations as they arise.
  3. It removes the need to document privacy decisions and controls.
  4. It applies only to organizations operating in a single jurisdiction.

Explanation

Accountability requires organizations to take responsibility for privacy outcomes and be able to demonstrate compliance on an ongoing basis. It is broader than reacting to investigations and depends on documentation and evidence.

Question 23Develop a Privacy Strategy

A privacy program reports the number of data subject requests closed each month. What is the main limitation of this KPI?

  1. It cannot be calculated from case management systems.
  2. It always overstates the program's legal compliance level.
  3. It measures throughput, not quality or underlying privacy risk. Correct answer.
  4. It is irrelevant to privacy operations and should be discarded.

Explanation

Volume of closed requests shows operational throughput but not whether responses were accurate, timely, or indicative of deeper privacy problems. A useful KPI set pairs throughput with quality, timeliness, and root-cause measures.

Question 24Develop a Privacy Strategy

What is the primary strategic value of conducting privacy incident tabletop exercises?

  1. They replace the need for a written incident response plan.
  2. They test decisions, roles, and communications and reveal gaps. Correct answer.
  3. They guarantee that future incidents will be contained quickly.
  4. They satisfy every regulatory notification requirement automatically.

Explanation

Tabletop exercises simulate realistic scenarios to test decision-making, role clarity, escalation, and communications, exposing gaps before a real incident. They complement, but do not replace, plans or legal notification obligations.

Question 25Develop a Privacy Strategy

A new privacy strategy faces resistance from business units that see it as overhead. What is the most effective implementation approach?

  1. Mandate compliance through threats of disciplinary action alone.
  2. Implement every requirement at once across all business units.
  3. Delay all changes until resistance disappears naturally.
  4. Engage champions, communicate benefits, and fit existing workflows. Correct answer.

Explanation

Change management succeeds by building coalitions, framing privacy in business terms, and integrating requirements into existing processes so they feel less like an added burden. Coercion alone, delay, and big-bang rollout tend to increase resistance.

Question 26Develop a Privacy Strategy

Which statement best describes the function of a privacy strategy?

  1. It documents the technical controls used to secure personal data against unauthorized access.
  2. It catalogues the specific legal obligations that apply in each jurisdiction where the organization operates.
  3. It sets the long-term direction for how privacy will be managed in support of business goals. Correct answer.
  4. It records the outcomes of completed privacy impact assessments and their assigned owners.

Explanation

A privacy strategy defines long-term direction, priorities, and how privacy work supports the organization's objectives. Catalogues of legal obligations, control inventories, and PIA records are operational artefacts that sit beneath the strategy.

Question 27Develop a Privacy Strategy

An organization decides that privacy requirements must be identified and built into new products during the design phase rather than added after launch. Which principle does this reflect?

  1. Privacy by design Correct answer.
  2. Purpose limitation
  3. Data minimisation
  4. Privacy by default

Explanation

Privacy by design calls for privacy to be embedded into systems, processes, and products from the outset rather than retrofitted. The other options are substantive data protection rules that apply to collection and use, not to the point in the lifecycle at which privacy is addressed.

Question 28Develop a Privacy Strategy

A privacy strategy is most likely to be sustained over time when it is explicitly linked to which of the following?

  1. Its business goals and enterprise risk profile Correct answer.
  2. The volume of data subject requests the organization receives
  3. The seniority of the privacy office's staff
  4. The number of privacy notices the organization publishes each year

Explanation

Strategies endure when they are visibly connected to how the organization creates value and manages enterprise risk, because that is the language in which investment decisions are made. Notice counts, staffing seniority, and request volumes are operational details that do not establish strategic relevance.

Question 29Develop a Privacy Strategy

In privacy strategy development, what is the primary purpose of an environmental scan?

  1. To identify external trends and forces that may affect privacy priorities. Correct answer.
  2. To assign accountability for each privacy control to a named owner.
  3. To confirm that existing privacy notices meet current legal requirements.
  4. To estimate the cost of the privacy technology the organization plans to purchase.

Explanation

An environmental scan examines external forces such as regulatory change, technology shifts, market expectations, and competitor behaviour to inform strategic priorities. It is forward-looking and outward-facing, unlike notice review, budgeting, or control ownership, which are internal operational tasks.

Question 30Develop a Privacy Strategy

During strategy development, a privacy lead maps each stakeholder group by how much influence it has over the strategy and how much interest it has in privacy outcomes. What is the main value of this analysis?

  1. It helps tailor engagement and secure support for the strategy. Correct answer.
  2. It removes the need for executive sponsorship of the program.
  3. It establishes which stakeholders bear legal liability for privacy failures.
  4. It determines the order in which privacy controls will be implemented.

Explanation

Stakeholder mapping shows who must be informed, consulted, or persuaded, allowing engagement effort to be targeted where it most affects adoption. It does not allocate legal liability, sequence control implementation, or substitute for executive sponsorship.

Question 31Develop a Privacy Strategy

A privacy leader wants early warning that the strategy is drifting off course, before problems appear in incident counts. Which measure best serves this purpose?

  1. The number of privacy incidents reported in the last quarter
  2. Projects completing privacy review before build Correct answer.
  3. The amount paid in regulatory fines to date
  4. The total number of data subject requests resolved last year

Explanation

Measures taken before an outcome occurs, such as the proportion of projects reviewed prior to build, are leading indicators that reveal whether controls are being applied. Incidents, resolved requests, and fines are lagging indicators that record events only after they happen.

Question 32Develop a Privacy Strategy

An organization is acquiring a company that holds large consumer datasets. Which action best reflects strategic privacy thinking during due diligence?

  1. Deferring all privacy questions until the acquisition has closed and integration begins.
  2. Relying on the target's self-certification that its data practices are compliant.
  3. Assessing the target's data holdings, transfers, and remediation exposure. Correct answer.
  4. Assuming the acquirer's privacy notices will automatically cover the target's data.

Explanation

Due diligence is the point at which data-related liabilities can still influence price, deal terms, or the decision to proceed. Assessing what data exists, where it flows, and what remediation will cost converts an unknown exposure into a managed one.

Question 33Develop a Privacy Strategy

A multinational wants privacy expertise available in each business unit without duplicating a full privacy office everywhere. Which structure best supports this?

  1. A central team supported by trained champions in each business unit. Correct answer.
  2. Outsourcing all privacy decisions to an external law firm.
  3. Relying on each business unit to interpret privacy law independently.
  4. Centralizing every privacy decision in the corporate legal department.

Explanation

A hub-and-spoke model keeps standards and expert judgment centralized while distributed champions provide local context and first-line support. This scales capacity without creating inconsistent interpretation across units.

Question 34Develop a Privacy Strategy

Which event should most clearly trigger a review of an organization's privacy strategy?

  1. The departure of a mid-level privacy analyst
  2. A routine software patch applied to the privacy platform
  3. The annual update of the employee privacy notice
  4. A material change in business model, data use, or law Correct answer.

Explanation

Strategy is calibrated to the organization's business model, data flows, and legal environment, so material change in any of these invalidates its underlying assumptions. Routine maintenance activities and individual staffing changes are handled through normal operations.

Question 35Develop a Privacy Strategy

Why should a privacy strategy address ethical data use that goes beyond strict legal compliance?

  1. Because regulators require documented ethics policies in every jurisdiction.
  2. Because ethical commitments are legally enforceable in the same way as statutes.
  3. Because ethical analysis removes the need to conduct privacy impact assessments.
  4. Because lawful practices can still erode trust and invite regulation. Correct answer.

Explanation

Law typically lags technology and practice, so conduct that is technically permitted can still damage customer trust and provoke future rulemaking. Addressing ethical expectations early protects reputation and reduces the likelihood of being caught by later regulation.

Question 36Develop a Privacy Strategy

A privacy team has limited budget and more initiatives than it can fund. Which basis for sequencing the work is most defensible?

  1. Ranking initiatives by risk severity and imminent legal deadlines Correct answer.
  2. Starting with the initiatives requested by the most senior business leader
  3. Starting with the initiatives that are easiest to complete within the current quarter
  4. Choosing initiatives in the order they appear in the privacy policy

Explanation

Resource allocation in a privacy program is risk-based, so initiatives are ordered by the likelihood and impact of the harm they prevent, with binding deadlines treated as non-negotiable. Ease, seniority of the requester, and document order are not measures of risk.

Question 37Develop a Privacy Strategy

An organization wants to adopt generative AI tools across its operations while preserving its privacy commitments. Which strategic position is most sound?

  1. Delegate decisions about AI data use entirely to the IT department.
  2. Allow any tool that a business unit finds productivity-enhancing, subject to later review.
  3. Prohibit all generative AI use until regulators issue definitive guidance.
  4. Adopt a framework setting data-use rules with pre-deployment review. Correct answer.

Explanation

A governing framework with defined rules and pre-deployment assessment lets the organization capture value while keeping data use within agreed boundaries. Blanket prohibition forfeits competitive ground, while permissive or delegated approaches leave consequential decisions unexamined.

Question 38Develop a Privacy Strategy

An organization's strategy describes privacy as a competitive advantage. Which action best turns that claim into something the market can verify?

  1. Reducing the length of the external privacy notice by half
  2. Adding the word "privacy" to the corporate mission statement
  3. Shipping verifiable privacy features and reporting on them publicly Correct answer.
  4. Appointing a chief privacy officer without changing product practice

Explanation

A differentiation claim becomes credible only when customers can observe and test the underlying controls, which requires actual product features and transparent reporting. Stated commitments, shorter notices, or new titles do not by themselves change what the product does.

Question 39Develop a Privacy Strategy

An organization operates in many jurisdictions with differing privacy requirements. Which approach best balances global consistency with local legal obligations?

  1. Adopting the rules of the headquarters country in every location.
  2. Letting each country's team write its own rules with no shared baseline.
  3. A global baseline of standards plus documented local supplements. Correct answer.
  4. Applying the strictest local law everywhere, regardless of cost or operational impact.

Explanation

A common baseline delivers consistent protection and manageable operations, while documented local supplements address requirements the baseline does not meet. This avoids both the rigidity of a single global maximum and the fragmentation of wholly local rulemaking.

Question 40Develop a Privacy Strategy

What is the main strategic benefit of a defensible data retention and disposal schedule?

  1. It reduces breach exposure and lowers storage and discovery costs. Correct answer.
  2. It eliminates the need to maintain records of processing activities.
  3. It allows data to be kept indefinitely as long as it is encrypted.
  4. It guarantees that no data subject request will ever be upheld.

Explanation

Deleting data once it is no longer needed shrinks the volume that can be lost in a breach and reduces the cost of storage and legal discovery. Retention limits do not affect the obligation to record processing, determine request outcomes, or legitimise indefinite storage.

Question 41Develop the Privacy Program Framework

Which component establishes decision-making authority and accountability for privacy across an organization?

  1. A documented governance structure with defined roles and reporting lines Correct answer.
  2. A schedule of upcoming marketing campaigns
  3. A list of the countries where the organization sells products
  4. A catalog of employee benefits offered by region

Explanation

A privacy program framework rests on governance: who decides, who is accountable, and how issues escalate. Documented roles and reporting lines make accountability enforceable rather than assumed. Operational artifacts such as campaign calendars or benefit catalogs do not allocate privacy responsibility.

Question 42Develop the Privacy Program Framework

Which role typically coordinates privacy strategy and the day-to-day operation of the privacy program?

  1. Head of sales
  2. Chief financial officer
  3. Facilities manager
  4. Privacy officer Correct answer.

Explanation

The privacy officer (or equivalent program lead) is the role conventionally charged with coordinating strategy, policy, and program operations, often with a supporting privacy office. Financial, facilities, and sales roles own different domains and hold only supporting privacy responsibilities.

Question 43Develop the Privacy Program Framework

Which document typically sets the highest-level, organization-wide commitments to privacy and is approved by senior leadership?

  1. The privacy policy or charter Correct answer.
  2. A department-level work instruction
  3. A vendor onboarding checklist
  4. A standard operating procedure for the call center

Explanation

Program frameworks place a top-level privacy policy or charter at the apex of the documentation hierarchy, articulating commitments and authority approved at senior levels. Lower-level procedures, checklists, and work instructions implement that policy at the operational level.

Question 44Develop the Privacy Program Framework

Privacy by design calls for privacy requirements to be addressed at which point in a project?

  1. Only during the annual audit cycle
  2. Once the product has launched to customers
  3. At the earliest design stage Correct answer.
  4. After a data breach has been confirmed

Explanation

Privacy by design embeds privacy proactively, so requirements are identified and built in before architecture and workflows are fixed. Retrofitting privacy after launch or after an incident is reactive and typically costlier and less effective.

Question 45Develop the Privacy Program Framework

What is the primary purpose of maintaining a data inventory or record of processing activities?

  1. To track competitor pricing and promotions
  2. To list physical office assets and equipment
  3. To document what personal data is processed, why, and by whom Correct answer.
  4. To record employee vacation and leave schedules

Explanation

A data inventory or record of processing activities gives the program a factual picture of data categories, purposes, recipients, and retention, which underpins risk assessment, rights fulfillment, and reporting. It is a privacy-specific record rather than a general asset or HR register.

Question 46Develop the Privacy Program Framework

Which element of a privacy program framework ensures employees understand their obligations when handling personal data?

  1. The annual financial audit
  2. The product roadmap
  3. The corporate social responsibility report
  4. Privacy awareness training Correct answer.

Explanation

A training and awareness program translates policy into expected behavior and is a standard pillar of a privacy framework. Financial audits, CSR reporting, and product planning do not deliver role-based privacy instruction.

Question 47Develop the Privacy Program Framework

When defining the scope of a privacy program, what should an organization primarily consider?

  1. The laws, data types, and processes in scope Correct answer.
  2. Only the preferences of the marketing team
  3. The number of office locations only
  4. Only the size of the legal department

Explanation

Scope is set by reference to the legal regimes that apply, the categories of personal data handled, and the business processes and systems involved. Internal team preferences, headcount, or site counts are not determinants of what the program must cover.

Question 48Develop the Privacy Program Framework

Which principle requires an organization to be able to demonstrate compliance with its privacy obligations?

  1. Storage limitation
  2. Data minimization
  3. Purpose limitation
  4. Accountability Correct answer.

Explanation

Accountability obliges an organization not only to comply but to evidence that compliance through documentation, controls, and records. Minimization, purpose limitation, and storage limitation constrain how data is collected, used, and retained but do not themselves impose the demonstration requirement.

Question 49Develop the Privacy Program Framework

A multinational retailer wants executives from legal, IT, HR, and marketing to resolve cross-functional privacy decisions together. What is the most appropriate mechanism?

  1. An ad hoc email thread started after each incident
  2. Outsourcing all decisions to an external law firm
  3. A chartered privacy steering committee Correct answer.
  4. Delegating all decisions to a single business unit

Explanation

Cross-functional decisions need a standing body with documented membership, mandate, and escalation paths, which a chartered steering committee provides. Ad hoc threads, single-unit control, and full outsourcing remove organizational ownership and leave decisions undocumented.

Question 50Develop the Privacy Program Framework

In a three lines of defense model, which group provides independent oversight and assurance over the privacy program?

  1. Business units that own the data and processes
  2. The IT service desk
  3. The privacy compliance function
  4. Internal audit Correct answer.

Explanation

The first line owns and manages risk in the business, the second line (privacy compliance) monitors and advises, and internal audit as the third line gives independent assurance to the board. The service desk performs operational support and belongs to neither assurance layer.