I85PREP
⌘ K
CDPSE study materials
CDPSE study resources

CDPSE practice questions

One question at a time. Build your CDPSE understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Privacy Governance

Which document most directly establishes the authority and accountability structure for an organization's privacy program?

  1. The record of processing activities maintained by the privacy office
  2. The privacy governance charter approved by executive leadership Correct answer.
  3. The data subject request log kept by the service desk
  4. The privacy notice published on the public website

Explanation

A governance charter is the instrument that assigns decision rights, accountability, and reporting lines for the privacy program, and it is approved at executive or board level. Operational records such as processing inventories and request logs are outputs of the program, not the source of its authority. The public privacy notice communicates practices to data subjects rather than defining internal accountability.

Question 2Privacy Governance

A privacy office reports to the Chief Legal Officer, while the business units that collect personal data set their own retention periods. Which governance weakness does this most clearly illustrate?

  1. Overreliance on automated controls for retention enforcement
  2. Inadequate funding for privacy awareness training
  3. Excessive centralization of privacy decision rights in the legal function
  4. Insufficient accountability for privacy decisions at the point of data collection Correct answer.

Explanation

When business units independently determine retention without a defined decision-rights framework, accountability for privacy outcomes is fragmented and unenforceable. Governance requires that privacy decision authority be explicitly assigned and documented, not left to local discretion. The scenario describes diffusion of authority, not centralization or training shortfalls.

Question 3Privacy Governance

Which committee structure best supports privacy governance in a large multinational organization?

  1. A project team convened solely when a data breach occurs
  2. An audit committee that reviews privacy only during the annual financial audit
  3. A cross-functional privacy steering committee with representatives from legal, IT, HR, and business lines Correct answer.
  4. A working group composed only of the privacy office staff

Explanation

Effective privacy governance requires cross-functional representation so that legal, technical, and business perspectives inform decisions and commitments are carried back to each function. A privacy-only group lacks the authority and reach to embed requirements across the enterprise. Audit committees and incident teams have narrower mandates that do not provide ongoing program oversight.

Question 4Privacy Governance

An organization wants to demonstrate that its privacy program aligns with a recognized international standard for privacy information management. Which standard should it reference?

  1. ISO/IEC 27701 Correct answer.
  2. ISO 9001
  3. ISO 31000
  4. ISO/IEC 27001

Explanation

ISO/IEC 27701 extends information security management to privacy information management and provides guidance for controllers and processors. ISO/IEC 27001 addresses information security management systems without privacy-specific controls. ISO 9001 covers quality management and ISO 31000 covers risk management generally.

Question 5Privacy Governance

A privacy manager is drafting a policy that defines how long personal data may be retained. Which element is most essential for the policy to be operable?

  1. A statement that retention will be determined case by case by the data owner
  2. Retention periods tied to specific data categories and stated business or legal justification Correct answer.
  3. A clause delegating retention decisions entirely to the IT storage team
  4. A requirement that all personal data be deleted within thirty days of collection

Explanation

A retention policy is operable only when periods are mapped to data categories and supported by a documented legal or business rationale that can be audited. Leaving decisions to individual owners or storage teams without criteria produces inconsistent, indefensible outcomes. A blanket thirty-day rule ignores statutory retention obligations and legitimate business needs.

Question 6Privacy Governance

Which role is typically accountable for approving the organization's privacy risk appetite statement?

  1. The board of directors or an executive risk committee Correct answer.
  2. The third-party vendor manager
  3. The privacy analyst who performs assessments
  4. The data center operations supervisor

Explanation

Risk appetite reflects the organization's willingness to accept risk and must be set at the highest governance level, typically the board or an executive risk committee. Analysts, vendor managers, and operations staff apply or inform the appetite but cannot define it. Assigning this authority lower in the organization undermines its legitimacy and enforceability.

Question 7Privacy Governance

An organization's privacy policy states commitments that its actual data handling practices do not meet. Which governance control most directly addresses this gap?

  1. Periodic policy-to-practice attestation with evidence reviewed by an independent function Correct answer.
  2. Delegation of policy interpretation to each regional sales office
  3. Annual republication of the privacy notice with an updated effective date
  4. Addition of more legal disclaimers to the customer-facing website

Explanation

Governance requires assurance that stated commitments are actually implemented, which is achieved through attestation supported by evidence and reviewed independently. Republishing notices or adding disclaimers changes communication, not behavior. Decentralizing interpretation increases divergence between policy and practice.

Question 8Privacy Governance

Which metric best indicates whether privacy training is effective rather than merely delivered?

  1. The count of training modules available in the learning system
  2. The rate at which employees correctly apply privacy requirements in role-based scenario assessments Correct answer.
  3. The percentage of employees who opened the training invitation email
  4. The total number of training hours recorded per department

Explanation

Effectiveness is measured by demonstrated competence in realistic scenarios, not by attendance or content volume. Open rates, hours logged, and module counts are activity measures that show delivery occurred but say nothing about behavior change. Governance reporting should favor outcome-oriented indicators.

Question 9Privacy Governance

In a privacy governance model, what is the primary purpose of a data protection impact assessment policy?

  1. To record every processing activity regardless of risk level
  2. To transfer liability for processing to the technology vendor
  3. To define when and how high-risk processing is assessed and who approves the outcome Correct answer.
  4. To replace the need for a record of processing activities

Explanation

A DPIA policy establishes triggers, methodology, and approval authority so that high-risk processing is systematically evaluated before it begins. It is risk-targeted and does not apply uniformly to all processing. It neither shifts liability to vendors nor substitutes for the processing inventory, which serves a different documentation purpose.

Question 10Privacy Governance

A regulator requests evidence of management oversight of the privacy program. Which artifact is most responsive?

  1. The organization's public privacy notice
  2. The employee handbook section on acceptable use of email
  3. A list of privacy tools licensed by the organization
  4. Minutes of privacy steering committee meetings showing decisions, owners, and follow-up actions Correct answer.

Explanation

Oversight is evidenced by records showing that governance bodies met, made decisions, assigned owners, and tracked remediation. A public notice, a tool inventory, or a general acceptable-use section does not demonstrate management engagement with privacy risk. Regulators look for documented, recurring accountability.

Question 11Privacy Governance

Which approach best integrates privacy into an organization's existing enterprise risk management framework?

  1. Registering privacy risks in the enterprise risk register with consistent scoring and ownership Correct answer.
  2. Reporting privacy risk only after an incident has occurred
  3. Maintaining a separate privacy risk list that is never reconciled with enterprise reporting
  4. Treating privacy risk as a purely legal matter outside enterprise risk reporting

Explanation

Integration occurs when privacy risks are recorded, scored, and owned using the same methodology as other enterprise risks, enabling comparability and prioritization. A disconnected list fragments visibility, and incident-only or legal-only treatment prevents proactive management. Consistent scoring is what makes privacy risk governable alongside other risk types.

Question 12Privacy Governance

What distinguishes a privacy program maturity assessment from a compliance checklist?

  1. It measures the number of privacy incidents reported in a year
  2. It lists the jurisdictions in which the organization operates
  3. It confirms only that required documents exist in the repository
  4. It evaluates the consistency and sustainability of capabilities across the program, not just presence of controls Correct answer.

Explanation

Maturity assessment examines whether capabilities are repeatable, measured, and continuously improved, whereas a checklist confirms that specific items exist. Document presence and incident counts are point-in-time indicators that do not reveal capability strength. Jurisdictional scope describes reach rather than maturity.

Question 13Privacy Governance

An organization appoints a data protection officer who also leads the marketing analytics team. Why does this create a governance concern?

  1. The combined role creates a conflict between monitoring compliance and owning the processing being monitored Correct answer.
  2. The marketing team lacks the technical skills to perform privacy tasks
  3. The appointment requires approval from every customer before it takes effect
  4. The arrangement reduces the number of staff available for marketing analysis

Explanation

Independence is essential for the oversight role; a DPO who directs the processing activity cannot objectively monitor it. The concern is structural conflict of interest, not staffing levels or skills. Customer-by-customer approval is not a requirement for such an appointment.

Question 14Privacy Governance

Which control best ensures that privacy requirements are considered before a new customer analytics platform is deployed?

  1. A gated intake process requiring privacy review and sign-off at defined project milestones Correct answer.
  2. A voluntary advisory channel that developers may consult at their discretion
  3. A post-deployment audit conducted twelve months after launch
  4. An annual privacy notice update covering all analytics tools

Explanation

Privacy by design is enforced through mandatory gates at defined milestones, where review occurs before commitments are locked in and changes are inexpensive. Post-deployment audits detect problems too late, and voluntary consultation is easily bypassed. Notice updates describe outcomes but do not embed requirements in delivery.

Question 15Privacy Governance

What is the primary governance purpose of maintaining a personal data inventory at the enterprise level?

  1. To provide a reliable basis for scoping assessments, responding to requests, and reporting to leadership Correct answer.
  2. To replace the need for vendor due diligence
  3. To serve as the organization's public transparency report
  4. To satisfy a one-time documentation requirement at project initiation

Explanation

An enterprise inventory creates a single authoritative view of processing that supports impact assessments, request fulfillment, and management reporting. It must be maintained continuously rather than produced once. It complements rather than replaces vendor diligence, and it is an internal record rather than a public disclosure.

Question 16Privacy Governance

A privacy office wants to allocate limited resources to the highest-value governance activities. Which criterion should drive prioritization?

  1. The ease with which an activity can be completed by existing staff
  2. The number of prior years the activity has been performed
  3. The visibility of an activity to external stakeholders
  4. The degree to which an activity reduces risk to individuals and the organization relative to its cost Correct answer.

Explanation

Governance prioritization should be risk-based, weighing risk reduction against cost so that resources target the most consequential exposures. Convenience, visibility, and tradition are not measures of value and can entrench low-impact activities. Risk-based allocation is a core expectation of privacy governance.

Question 17Privacy Governance

Which arrangement best supports consistent privacy decision-making across decentralized business units?

  1. A documented escalation path with defined thresholds and a central privacy authority for exceptions Correct answer.
  2. A single annual meeting where units share informal practices
  3. Full autonomy for each unit to interpret privacy law independently
  4. Reliance on external counsel to answer each question as it arises

Explanation

Consistency comes from clear escalation thresholds and a central authority empowered to resolve exceptions, which prevents divergent interpretations. Full autonomy and informal sharing produce inconsistent outcomes. Ad hoc reliance on external counsel is costly and does not build internal governance capability.

Question 18Privacy Governance

Which statement best describes the relationship between privacy governance and information security governance?

  1. They are identical and can be managed by a single combined policy without distinction
  2. They are complementary, sharing risk assessment inputs while pursuing distinct objectives for data protection and confidentiality Correct answer.
  3. They are unrelated and should never share risk information
  4. Privacy governance strictly supersedes information security governance

Explanation

Privacy and security governance overlap in risk assessment and control environments but differ in objectives: privacy addresses lawful and fair handling of personal data, while security addresses confidentiality, integrity, and availability. Treating them as identical obscures obligations such as consent and purpose limitation. Neither discipline supersedes the other.

Question 19Privacy Governance

What is the role of a privacy champion network in a governance framework?

  1. To extend privacy practices into business units by acting as trained local points of contact and escalation Correct answer.
  2. To approve the organization's enterprise risk appetite
  3. To replace the privacy office in making regulatory determinations
  4. To conduct independent audits of the privacy program

Explanation

Champions embed privacy awareness and first-line guidance within business units, improving reach and early escalation while the privacy office retains interpretive authority. They do not make regulatory determinations, perform independent audits, or set enterprise risk tolerance. Their value lies in distributed capability with clear boundaries.

Question 20Privacy Governance

A privacy program's key risk indicator shows a rising trend in unapproved tools handling customer data. What governance response is most appropriate?

  1. Wait for the next annual risk assessment cycle before acting
  2. Assign the issue to the privacy office without executive visibility
  3. Remove the indicator from reporting to avoid negative attention
  4. Escalate to the steering committee with proposed controls, owners, and a remediation timeline Correct answer.

Explanation

A trending key risk indicator should trigger escalation with concrete proposed treatments, accountable owners, and timelines so leadership can direct resources. Deferring to an annual cycle allows the exposure to grow, and suppressing or isolating the indicator defeats the purpose of monitoring. Governance effectiveness depends on timely, visible response.

Question 21Privacy Governance

Which element is most important when defining privacy roles and responsibilities in a RACI matrix?

  1. Assigning every activity to as many roles as possible for coverage
  2. Listing only the privacy office to simplify the matrix
  3. Omitting consulted and informed parties to reduce complexity
  4. Ensuring each privacy activity has exactly one accountable owner Correct answer.

Explanation

A RACI matrix functions only when accountability is singular and unambiguous for each activity, so that escalation and ownership are clear. Assigning many accountable parties diffuses responsibility, and omitting consulted or informed roles hides dependencies. Simplicity must not come at the cost of clarity about who decides.

Question 22Privacy Governance

What is the primary purpose of an annual privacy program review by internal audit?

  1. To provide independent assurance that governance and controls operate as intended Correct answer.
  2. To approve the privacy budget for the coming year
  3. To manage data subject requests during peak volume
  4. To design new privacy controls for the business

Explanation

Internal audit provides independent, objective assurance on the design and operating effectiveness of governance and controls. Designing controls or executing operations compromises independence, and budget approval is a management and governance responsibility. Independence is the defining feature of the audit function.

Question 23Privacy Governance

An organization operates in multiple jurisdictions with differing consent requirements. Which governance approach best manages the resulting complexity?

  1. Allow each local office to set its own consent standard without documentation
  2. Suspend consent-based processing in all jurisdictions to avoid conflicts
  3. Apply the least restrictive jurisdiction's rules uniformly across all operations
  4. Establish a baseline standard meeting the strictest applicable requirement, with documented local variations Correct answer.

Explanation

A harmonized baseline anchored to the strictest requirement, supplemented by documented local variations, reduces complexity while preserving compliance. Applying the least restrictive rule creates violations elsewhere, and undocumented local discretion prevents oversight. Abandoning consent-based processing is a disproportionate business decision.

Question 24Privacy Governance

Which reporting line best preserves the objectivity of the privacy function in a governance structure?

  1. Reporting to the marketing analytics lead
  2. Reporting to the IT service desk manager
  3. Reporting to the head of sales, who owns the largest customer data sets
  4. Reporting to an executive or board-level body with authority independent of the business units it oversees Correct answer.

Explanation

Objectivity requires that the privacy function report to a level with authority independent of the units whose processing it oversees. Reporting to sales, IT operations, or marketing places oversight under the functions being monitored. Independence in the reporting line is a foundational governance safeguard.

Question 25Privacy Governance

A privacy governance program defines a policy exception process. Which design element most strengthens that process?

  1. Time-bound approvals with compensating controls and recorded risk acceptance by an authorized owner Correct answer.
  2. Automatic approval when the requester cites business urgency
  3. Exceptions available to any employee without review
  4. Permanent exceptions granted verbally by the requesting manager

Explanation

Exceptions should be temporary, risk-accepted by an authorized owner, and paired with compensating controls so residual risk is understood and limited. Verbal, permanent, or unreviewed exceptions remove accountability and allow risk to accumulate unnoticed. Recording acceptance is what makes the exception defensible.

Question 26Privacy Governance

Which document typically establishes an organization's privacy principles and the high-level commitments that all lower-level privacy standards must align with?

  1. The vendor security questionnaire
  2. The incident response runbook
  3. The enterprise privacy policy Correct answer.
  4. The data processing inventory

Explanation

An enterprise privacy policy is the top-level governance instrument: it states the principles and commitments from which standards, procedures, and controls are derived. Lower-level documents must be traceable to it so that auditors and regulators can see a coherent policy hierarchy. Inventories and questionnaires are operational artifacts, not sources of principle.

Question 27Privacy Governance

A privacy program has a policy but no documented procedures, and staff interpret the policy differently in each region. Which governance gap does this most directly represent?

  1. Excessive regulatory scope
  2. Insufficient policy operationalization Correct answer.
  3. Inadequate data subject access capacity
  4. Weak encryption standards

Explanation

A policy states intent, while procedures translate that intent into consistent repeatable actions. When only policy exists, interpretation drifts across regions and outcomes become inconsistent. The gap is therefore in operationalizing the policy, not in scope, access handling, or cryptography.

Question 28Privacy Governance

Which body is most commonly accountable for overseeing the privacy program and escalating privacy risk to executive leadership?

  1. A privacy steering committee Correct answer.
  2. An external penetration testing firm
  3. The accounts payable team
  4. The service desk

Explanation

A privacy steering committee is a governance forum with cross-functional authority to oversee the program, prioritize work, and escalate risk to executives. Operational teams and external testers contribute evidence but do not carry program oversight accountability.

Question 29Privacy Governance

Which principle requires that personal data be collected only for specified, explicit purposes and not used incompatibly with them?

  1. Accuracy
  2. Purpose limitation Correct answer.
  3. Data minimization
  4. Storage limitation

Explanation

Purpose limitation constrains collection and later use to the purposes specified at collection time, unless a compatible or lawful basis exists for new use. Storage limitation concerns retention periods, minimization concerns volume, and accuracy concerns correctness of the data.

Question 30Privacy Governance

An organization wants to embed privacy review into its existing change management workflow so that new systems cannot go live without a privacy assessment. Which design achieves this most reliably?

  1. Add a privacy question to the annual employee engagement survey
  2. Publish a privacy awareness article on the intranet each quarter
  3. Ask project managers to email the privacy office when they remember
  4. Make a completed privacy assessment a mandatory gate in the change approval workflow Correct answer.

Explanation

Embedding the requirement as a mandatory gate in the workflow that already controls go-live makes compliance automatic rather than voluntary. Awareness and survey activities influence culture but cannot prevent an unreviewed system from deploying. Reliance on discretionary notification produces inconsistent coverage.

Question 31Privacy Governance

A privacy office must demonstrate that its control environment addresses regulatory obligations across several jurisdictions. Which governance artifact best provides this traceability?

  1. A list of every privacy law enacted worldwide
  2. A folder of screenshots from the previous audit
  3. A control mapping that links each obligation to the responsible control, owner, and evidence Correct answer.
  4. A summary of privacy incidents from the last year

Explanation

Traceability requires an explicit link between each obligation, the control that satisfies it, the accountable owner, and the evidence produced. A control mapping provides that chain and supports audit and gap analysis. Raw law lists, screenshots, and incident summaries lack the structured linkage.

Question 32Privacy Governance

When senior management accepts a privacy risk that exceeds the approved risk appetite, what should the governance process require?

  1. A documented, time-bound exception approved at the appropriate authority level Correct answer.
  2. Removal of the risk from the risk register
  3. Silent acceptance so that the decision is not discoverable
  4. Delegation of the decision to the project team that raised the risk

Explanation

Accepting risk above appetite requires a formal exception with an accountable approver, rationale, compensating measures, and an expiry or review date. This preserves accountability and allows oversight bodies to see the decision. Informal acceptance or hiding the risk undermines governance.

Question 33Privacy Governance

Which characteristic most clearly distinguishes a privacy framework from a privacy standard?

  1. A framework is written by regulators, while a standard is written by auditors
  2. A framework applies only to vendors, while a standard applies to employees
  3. A framework provides a structured approach and outcomes, while a standard specifies mandatory requirements Correct answer.
  4. A framework is legally binding, while a standard is voluntary

Explanation

Frameworks describe structures, categories, and desired outcomes that help organize a program, whereas standards set specific mandatory requirements an organization commits to. Binding force and authorship vary by source and do not define the distinction.

Question 34Privacy Governance

A multinational firm must reconcile local consent rules that conflict with a group-wide marketing standard. Which governance mechanism resolves this most appropriately?

  1. Suspension of all marketing until laws converge
  2. Uniform enforcement of the group standard in every jurisdiction
  3. Case-by-case decisions by each marketing manager
  4. A documented local-law precedence rule that permits stricter local requirements to override the group standard Correct answer.

Explanation

A precedence rule that requires compliance with the stricter applicable requirement gives predictable, defensible outcomes while preserving the group standard as a baseline. Uniform enforcement ignores legal differences, and ad hoc decisions create inconsistency and legal exposure.

Question 35Privacy Governance

Which set of responsibilities best reflects the principle of accountability in a privacy operating model?

  1. Responsibility transferred entirely to external counsel
  2. Responsibility assigned only to the IT department
  3. A named executive owner, defined decision rights, and periodic reporting to a governing body Correct answer.
  4. Shared responsibility with no single named owner

Explanation

Accountability requires an identifiable owner with authority, clear decision rights, and reporting so that oversight can occur. Diffuse or outsourced responsibility without internal ownership leaves no one answerable for outcomes.

Question 36Privacy Governance

An organization wants privacy requirements reflected in procurement. Which control is most effective at the governance level?

  1. A reminder in the procurement team's monthly meeting agenda
  2. An annual email to suppliers summarizing privacy expectations
  3. A voluntary checklist available on request
  4. Mandatory privacy clauses and a privacy review step built into the procurement workflow Correct answer.

Explanation

Binding contract clauses combined with a mandatory review step ensure privacy terms are present and assessed before any purchase proceeds. Voluntary or advisory measures depend on discretion and cannot assure coverage across all engagements.

Question 37Privacy Governance

A privacy program reports strong policy coverage but a rising number of repeat findings in the same business unit. Which governance response addresses the root cause most directly?

  1. Increase the frequency of the same awareness email
  2. Lower the severity rating of the findings
  3. Escalate to the unit's leadership and require a remediation plan with owners and dates Correct answer.
  4. Broaden the audit scope to other business units

Explanation

Repeat findings indicate that remediation is not being owned or sustained locally, so escalation with accountable owners and deadlines targets the underlying failure. Repeating awareness messaging or expanding scope does not fix the unit's behavior, and downgrading severity conceals the problem.

Question 38Privacy Governance

Which arrangement best preserves the independence of an internal privacy audit function?

  1. The audit team reports to the audit committee rather than to the privacy program owner Correct answer.
  2. The audit team reports to the chief privacy officer it audits
  3. The audit team's findings are reviewed by the privacy office before release
  4. The audit team is staffed by the same analysts who designed the controls

Explanation

Independence requires that assurance providers are not subordinate to, or filtered by, the function they assess. Reporting to the audit committee preserves objectivity and unfiltered escalation. Reporting to the audited owner or pre-clearing findings compromises that objectivity.

Question 39Privacy Governance

A regulator asks how the board satisfies itself that privacy risk is managed. Which practice provides the strongest governance evidence?

  1. A one-time board briefing held at program launch
  2. Board minutes that mention privacy only during incident years
  3. A recurring board report showing privacy risk posture, appetite breaches, and remediation status Correct answer.
  4. A privacy policy signed by the chief executive

Explanation

Ongoing board reporting on risk posture, appetite exceptions, and remediation demonstrates continuous oversight rather than a single event. Signed policies and occasional mentions show intent but not sustained monitoring of risk.

Question 40Privacy Governance

An organization is designing metrics for its privacy governance dashboard. Which metric best measures governance effectiveness rather than activity volume?

  1. Number of privacy assessments completed in the quarter
  2. Percentage of high-risk processing activities with an approved assessment before launch Correct answer.
  3. Number of employees who opened the privacy newsletter
  4. Total hours logged by the privacy office

Explanation

Effectiveness metrics show whether controls achieved their objective, such as ensuring high-risk processing was assessed before it began. Volume counts of assessments, newsletter opens, and hours measure activity or reach, not whether risk was actually managed.

Question 41Privacy Risk Management and Compliance

A privacy office is drafting a record of processing activities under GDPR Article 30. Which data element is mandatory for each processing activity in that record?

  1. The name of the database administrator
  2. The vendor's security certification
  3. The retention period of backup tapes
  4. The purposes of the processing Correct answer.

Explanation

Article 30 requires the record to state the purposes of processing for each activity, alongside categories of data subjects and personal data, recipients, transfers, and time limits. Backup tape retention and staff names are operational details that are not required elements of the record.

Question 42Privacy Risk Management and Compliance

Which principle limits an organization to collecting only the personal data that is necessary for the stated purpose?

  1. Storage limitation
  2. Accountability
  3. Integrity and confidentiality
  4. Data minimization Correct answer.

Explanation

Data minimization requires that personal data be adequate, relevant, and limited to what is necessary for the purpose. Storage limitation concerns how long data is kept, and accountability concerns demonstrating compliance.

Question 43Privacy Risk Management and Compliance

A company wants to rely on consent for marketing emails to EU customers. Which condition must the consent satisfy to be valid under GDPR?

  1. It must be implied by the customer's prior purchase
  2. It must be freely given, specific, informed, and unambiguous Correct answer.
  3. It must be bundled into the general terms of service
  4. It must be renewed by the customer every 12 months

Explanation

Valid consent must be freely given, specific, informed, and unambiguous, expressed by a clear affirmative action. Bundled or implied consent does not meet the standard, and GDPR sets no fixed 12-month renewal rule.

Question 44Privacy Risk Management and Compliance

Under GDPR, within what period must a controller notify a supervisory authority of a personal data breach that is likely to result in a risk to individuals?

  1. 30 days of becoming aware
  2. 72 hours of becoming aware Correct answer.
  3. 24 hours of discovery
  4. 5 business days of discovery

Explanation

Article 33 requires notification to the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of the breach. Notification to affected individuals under Article 34 applies where there is a high risk.

Question 45Privacy Risk Management and Compliance

An organization is completing a data protection impact assessment for a new biometric access system. Which factor most strongly indicates that a DPIA is required?

  1. The system was procured from an external vendor
  2. The system has a documented change management process
  3. The system uses a cloud hosting provider
  4. The system processes special category data on a large scale Correct answer.

Explanation

Large-scale processing of special category data such as biometrics is one of the criteria that triggers a DPIA because it creates high risk to rights and freedoms. Cloud hosting, vendor procurement, and change management do not by themselves trigger the requirement.

Question 46Privacy Risk Management and Compliance

Which role determines the purposes and means of processing personal data?

  1. Data subject
  2. Data processor
  3. Data controller Correct answer.
  4. Supervisory authority

Explanation

The controller is the entity that alone or jointly with others determines the purposes and means of processing. Processors act on the controller's instructions, and supervisory authorities oversee compliance.

Question 47Privacy Risk Management and Compliance

A privacy manager is building a data inventory. Which attribute is most important to capture for each data element to support downstream compliance activities?

  1. The business purpose and lawful basis for processing Correct answer.
  2. The physical location of the server rack
  3. The software license expiry date
  4. The job title of the person who entered the record

Explanation

Recording the purpose and lawful basis for each data element lets the organization link processing to compliance obligations, respond to access requests, and scope assessments. Server location, data entry staff, and license dates are not core inventory attributes.

Question 48Privacy Risk Management and Compliance

A privacy program uses a risk register. What is the primary purpose of recording privacy risks in the register?

  1. To replace the need for a DPIA
  2. To satisfy marketing reporting requirements
  3. To transfer all liability to the IT department
  4. To track, prioritize, and monitor risk treatment decisions Correct answer.

Explanation

A risk register provides a structured way to document identified privacy risks, assign owners, prioritize treatment, and monitor progress over time. It does not transfer liability or substitute for a DPIA where one is required.

Question 49Privacy Risk Management and Compliance

A multinational retailer wants to transfer EU employee data to its US affiliate. Which mechanism can lawfully support the transfer under GDPR?

  1. A note in the employee handbook
  2. An adequacy decision or appropriate safeguards such as standard contractual clauses Correct answer.
  3. A verbal assurance from the receiving affiliate
  4. The fact that the affiliate is part of the same corporate group

Explanation

Transfers to a third country require an adequacy decision or appropriate safeguards such as standard contractual clauses, plus any supplementary measures needed. Corporate affiliation or informal assurances do not create a lawful transfer basis.

Question 50Privacy Risk Management and Compliance

A processor detects a breach affecting a controller's customers. According to GDPR Article 33, what should the processor do?

  1. Wait for the controller to ask for details
  2. Notify the supervisory authority directly within 72 hours
  3. Notify each affected individual immediately
  4. Notify the controller without undue delay Correct answer.

Explanation

A processor must notify the controller without undue delay after becoming aware of a breach. The controller then assesses risk and decides on notifications to the supervisory authority and individuals.