Privacy Risk Management and Compliance
CDPSE Domain 2, Privacy Risk Management and Compliance, tests your ability to identify privacy risk, assess it in terms of harm to individuals, treat it, and prove compliance.
Core rules and concepts
- Use a repeatable risk process: establish context, inventory processing, identify threats such as excessive collection, secondary use, unauthorized access, and over-retention, analyze likelihood and impact, evaluate against criteria, treat through mitigation, transfer, avoidance, or acceptance, and monitor.
- A PIA is broad; a DPIA is for likely high-risk processing such as systematic monitoring, sensitive data, or large-scale profiling. Trigger lists and screening questions make this consistent.
- A record of processing activities (ROPA) and data maps feed both risk assessment and compliance evidence.
- Compliance controls include lawful basis and notice, consent, DSAR handling, breach response, cross-border transfer mechanisms, and vendor contracts.
- Track risk with owners, due dates, residual risk, and approval authority. Monitor with KRIs, control testing, and audit findings.
Worked example
Marketing wants to upload a customer list to an ad platform for lookalike targeting. Risks include purpose limitation, consent scope, onward transfer, and re-identification. The team should document the purpose, confirm the lawful basis, execute a DPA, assess whether hashing is truly anonymizing (usually not), offer opt-out, set retention, and record residual risk. If risk remains high, a DPIA and senior approval are needed. The reasoning: risk treatment is documented, not assumed.
Traps
Assessing only regulatory fines and ignoring individual harm; running a DPIA after launch; calling pseudonymized data anonymous; missing onward transfers by vendors; starting the breach clock only after full confirmation; accepting risk without delegated authority.