I85PREP
⌘ K
ISO 27701 LA study materials
ISO 27701 LA study resources

ISO 27701 LA practice questions

One question at a time. Build your ISO 27701 LA understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Fundamental principles and concepts of a privacy information management system

ISO/IEC 27701 is best described as which type of standard?

  1. A replacement for ISO/IEC 27001 in organizations that process personal data
  2. A sector-specific standard for the healthcare and financial industries
  3. An extension to ISO/IEC 27001 and ISO/IEC 27002 for privacy management Correct answer.
  4. A technical standard for encrypting personal data at rest and in transit

Explanation

ISO/IEC 27701 is an extension to ISO/IEC 27001 and ISO/IEC 27002: it adds PIMS-specific requirements to the ISMS requirements and PIMS-specific guidance and controls to the information security control set. It is implemented alongside, not instead of, ISO/IEC 27001.

Question 2Fundamental principles and concepts of a privacy information management system

The entity that alone or jointly with others determines the purposes and means of processing PII is called the:

  1. PII processor
  2. PII principal
  3. PII controller Correct answer.
  4. Sub-contracted processor

Explanation

In ISO/IEC 29100 vocabulary used by ISO/IEC 27701, the PII controller determines why and how PII is processed. A processor only acts on the controller's instructions.

Question 3Fundamental principles and concepts of a privacy information management system

An organization processes PII strictly on behalf of, and on the documented instructions of, another organization. In ISO/IEC 27701 terms it is acting as a:

  1. Privacy regulator
  2. PII principal
  3. PII controller
  4. PII processor Correct answer.

Explanation

Processing PII on behalf of another party, and only on that party's documented instructions, is the defining characteristic of a PII processor. The organization that gave the instructions is the controller.

Question 4Fundamental principles and concepts of a privacy information management system

In the vocabulary used by ISO/IEC 27701, the individual to whom personal information relates is called the:

  1. PII processor
  2. Authorized user
  3. PII principal Correct answer.
  4. Data subject

Explanation

ISO/IEC 27701 adopts the ISO/IEC 29100 term PII principal for the individual to whom PII relates. The equivalent concept in the GDPR is the data subject.

Question 5Fundamental principles and concepts of a privacy information management system

What is the primary purpose of a privacy information management system (PIMS)?

  1. To record the consents obtained from customers in a central register
  2. To guarantee that the organization complies with every applicable privacy law
  3. To manage privacy risks and obligations through governed policies and controls Correct answer.
  4. To replace the organization's information security management system

Explanation

A PIMS provides a systematic, risk-based way to manage the organization's privacy obligations and PII protection risks through policies, roles, controls and continual improvement. It supports compliance without guaranteeing it, and it complements rather than replaces the ISMS.

Question 6Fundamental principles and concepts of a privacy information management system

What does 'privacy by design' require of an organization building a PIMS?

  1. Privacy settings are configured by the user before first use of a product
  2. Privacy risks are delegated to the legal department for annual review
  3. Privacy controls are added once a system has gone live and issues appear
  4. Privacy is considered from the outset and embedded in processes and systems Correct answer.

Explanation

Privacy by design means privacy is taken into account proactively, at the beginning of and throughout the design of systems, processes and products. Remediating privacy problems after launch is the opposite approach.

Question 7Fundamental principles and concepts of a privacy information management system

Which annex of ISO/IEC 27701 contains PIMS-specific control objectives and controls for organizations acting as PII controllers?

  1. Annex A Correct answer.
  2. Annex C
  3. Annex D
  4. Annex E

Explanation

Annex A holds the PIMS-specific control objectives and controls for PII controllers, while Annex B covers PII processors. Annex C is a mapping to ISO/IEC 27001 and ISO/IEC 27002, and Annex D maps to the GDPR.

Question 8Fundamental principles and concepts of a privacy information management system

Which statement describes a PIMS as defined in ISO/IEC 27701?

  1. A certification scheme administered by national privacy regulators
  2. A set of privacy notices published for customers and employees
  3. A software platform used to log access requests from individuals
  4. A management system addressing privacy in PII processing Correct answer.

Explanation

A PIMS is a management system: a structured set of interrelated policies, objectives, processes and controls for protecting privacy as it relates to PII processing. It is not a tool, a publication or a regulator-run scheme.

Question 9Fundamental principles and concepts of a privacy information management system

Within ISO/IEC 27701, where do the auditable PIMS requirements sit?

  1. In Annexes E and F only
  2. In clauses 7 and 8 only
  3. In clause 5, together with the applicable annex controls Correct answer.
  4. In clause 6, together with Annex D

Explanation

Clause 5 extends the ISO/IEC 27001 requirements with PIMS-specific requirements, and the applicable controls are found in Annexes A and B. Clause 6, clauses 7 and 8, and the remaining annexes provide guidance or mappings.

Question 10Fundamental principles and concepts of a privacy information management system

An organization is a controller for its own customer data and a processor for a client's data. How does ISO/IEC 27701 treat this situation?

  1. The client decides which role the organization must document
  2. Both sets of PIMS controls apply, each to the relevant processing Correct answer.
  3. The organization selects one role and applies only the corresponding annex
  4. Processor obligations always take precedence over controller obligations

Explanation

ISO/IEC 27701 recognizes that an organization can hold both roles, and each role brings its own set of applicable controls from Annex A or Annex B. Applying both, scoped to the relevant processing, is expected.

Question 11Fundamental principles and concepts of a privacy information management system

An organization acting as a PII processor wants to engage a sub-contractor to process PII. What does ISO/IEC 27701 expect?

  1. The organization may subcontract freely because it remains the processor
  2. The PII principal must be asked to consent to each sub-contractor
  3. The sub-contractor must be certified to ISO/IEC 27701 before onboarding
  4. The controller must authorize it and obligations must flow down Correct answer.

Explanation

A processor may only engage a sub-contractor with the controller's authorization, and the same privacy and security obligations must be passed down to the sub-contractor. The processor remains accountable to the controller for that work.

Question 12Fundamental principles and concepts of a privacy information management system

Which activity does ISO/IEC 27701 require an organization to perform for its PIMS?

  1. An annual audit by an accredited certification body
  2. A PII protection risk assessment that informs risk treatment Correct answer.
  3. A data protection impact assessment for every processing activity
  4. A penetration test of every system that stores PII

Explanation

Clause 5 requires PII protection risks to be identified, analysed, evaluated and treated in a way that is aligned with the ISMS risk process. Penetration tests, impact assessments and certification audits may be used but are not universal mandatory elements of every PIMS.

Question 13Fundamental principles and concepts of a privacy information management system

Annex D of ISO/IEC 27701 provides a mapping to which instrument?

  1. ISO/IEC 20000 service management
  2. ISO/IEC 27017 cloud security controls
  3. The EU General Data Protection Regulation Correct answer.
  4. The OECD privacy guidelines

Explanation

Annex D maps the clauses and controls of ISO/IEC 27701 to the articles of the GDPR, helping organizations relate their PIMS to that regulation. Other annexes cover mappings to ISO/IEC 27001 and 27002, ISO/IEC 29100, and ISO/IEC 27018 and 29151.

Question 14Fundamental principles and concepts of a privacy information management system

Which Annex A control objective addresses handling requests from individuals to access or correct their PII?

  1. Conditions for collection and processing
  2. Privacy by design and privacy by default
  3. PII sharing, transfer and disclosure
  4. Obligations to PII principals Correct answer.

Explanation

Obligations to PII principals covers providing information, and enabling access, correction and other rights of the individuals whose PII is processed. Collection conditions, design principles and transfers are separate control objectives.

Question 15Fundamental principles and concepts of a privacy information management system

Which record does ISO/IEC 27701 expect an organization to maintain as part of its PIMS documentation?

  1. Records of PII processing activities and of the roles involved Correct answer.
  2. Minutes of every meeting held by the privacy steering group
  3. A list of all suppliers connected to the corporate network
  4. A register of every employee's security clearance level

Explanation

Documented information about PII processing activities, including the roles of controller and processor, is expected so that the PIMS scope and controls can be justified and audited. Clearance registers, network asset lists and full meeting minutes are not PIMS documentation requirements.

Question 16Fundamental principles and concepts of a privacy information management system

Which outcome does the Annex control objective on PII sharing, transfer and disclosure seek to achieve?

  1. That the PII principal is notified after every internal use of the data
  2. That the receiving party signs a non-disclosure agreement with each PII principal
  3. That transfers are recorded only when they leave the organization's country
  4. That transfers are identified, documented and governed by defined rules Correct answer.

Explanation

The objective is that any sharing, transfer or disclosure of PII to another party is identified, recorded and carried out under defined rules and agreements. Internal use by the same organization and domestic-only transfers do not escape that governance.

Question 17Fundamental principles and concepts of a privacy information management system

Privacy by default, as addressed in ISO/IEC 27701, is best illustrated by which practice?

  1. PII collection is limited to what the marketing team requests
  2. Users are asked to accept the fullest data collection settings at sign-up
  3. Systems are configured so that only the minimum necessary PII is processed Correct answer.
  4. Privacy settings are documented after the product launch

Explanation

Privacy by default means the out-of-the-box configuration collects and exposes only the PII needed for the specified purpose, without requiring the individual to change settings. Requiring users to opt out of maximum collection is the reverse of the principle.

Question 18Fundamental principles and concepts of a privacy information management system

How does an organization document which PIMS-specific controls from Annexes A and B it applies?

  1. Through a statement of applicability that records inclusions and exclusions Correct answer.
  2. Through the register of PII principals maintained by the privacy office
  3. By attaching the annexes unmodified to the certification contract
  4. By listing them in the privacy notice published on its website

Explanation

As with the ISMS, a statement of applicability records which controls are applied, which are excluded and why, together with the justification. Attaching the annexes unchanged does not show that applicability has been considered.

Question 19Fundamental principles and concepts of a privacy information management system

An internal audit of the PIMS finds that defined retention periods were not applied. What should follow under the PIMS improvement requirements?

  1. The finding is logged but no action is needed if no complaint was made
  2. The audit scope is narrowed so the process is no longer covered
  3. Corrective action is taken and its effectiveness is reviewed Correct answer.
  4. The retention periods are deleted from the policy to close the finding

Explanation

Nonconformities must be corrected, the cause addressed, and the effectiveness of the action reviewed as part of continual improvement. Removing the requirement or shrinking the audit scope avoids the finding instead of resolving it.

Question 20Fundamental principles and concepts of a privacy information management system

When defining the scope of its PIMS, which consideration should an organization include?

  1. Only processing activities that use cloud services
  2. Only the systems operated by the privacy office
  3. Only the jurisdictions where it has physical offices
  4. Its roles as controller or processor and the PII processing covered Correct answer.

Explanation

The PIMS scope must reflect the organization's actual roles and the PII processing activities it covers, so that the applicable annex controls can be identified. Limiting scope by technology, department or office location alone would leave relevant processing outside the system.

Question 21Fundamental principles and concepts of a privacy information management system

How does the PII protection risk assessment in ISO/IEC 27701 relate to a purely organizational security risk assessment?

  1. It replaces the information security risk assessment entirely
  2. It considers the potential impact on PII principals, not only on the organization Correct answer.
  3. It uses likelihood only, because privacy impact cannot be quantified
  4. It is performed once, before the PIMS is first certified

Explanation

PII protection risk looks at the potential adverse effects on individuals whose PII is processed, in addition to risks to the organization. It is integrated with the ISMS risk process rather than replacing it, and it is repeated as changes occur.

Question 22Fundamental principles and concepts of a privacy information management system

An organization holds ISO/IEC 27701 certification. Which statement is correct?

  1. It may drop ISO/IEC 27001 controls that are not privacy related
  2. The certification proves compliance with all applicable privacy laws
  3. It was certified by a privacy regulator rather than an accredited body
  4. It was certified against ISO/IEC 27001 as well, since 27701 extends it Correct answer.

Explanation

ISO/IEC 27701 certification is issued as an extension of an ISO/IEC 27001 certification, so the ISMS must already be certified and its controls remain in force. Neither certification is a legal compliance finding, and certification is performed by accredited certification bodies, not regulators.

Question 23Fundamental principles and concepts of a privacy information management system

Which statement best describes the relationship between ISO/IEC 27701 and privacy legislation?

  1. It supersedes national law wherever the two conflict
  2. Certification exempts the organization from regulatory investigations
  3. The standard is legally binding in the jurisdictions that adopt it
  4. It provides a framework that supports compliance without certifying it Correct answer.

Explanation

ISO/IEC 27701 is a voluntary management system standard that helps an organization build the governance and controls needed to meet privacy obligations. It maps to instruments such as the GDPR but does not itself establish legal compliance or override law.

Question 24Fundamental principles and concepts of a privacy information management system

A PII principal asks a service provider for a copy of their PII, but the provider holds that data only as a processor for a client that is the controller. What does ISO/IEC 27701 expect the provider to do?

  1. Answer directly, because it physically holds the PII records
  2. Delete the data to avoid breaching the individual's request
  3. Refuse, since principals have no relationship with processors
  4. Refer the request to the controller and assist as agreed Correct answer.

Explanation

Requests about the exercise of principal rights are handled by the controller, and the processor supports the controller in doing so, as set out in the agreement between them. The processor does not respond on its own authority, refuse outright, or pre-emptively delete data.

Question 25Fundamental principles and concepts of a privacy information management system

ISO/IEC 29100, whose framework and terminology ISO/IEC 27701 builds upon, identifies which set of privacy safeguarding requirements?

  1. Consent, notice and choice
  2. Accuracy, minimization and retention
  3. Unlinkability, transparency and intervenability Correct answer.
  4. Confidentiality, integrity and availability

Explanation

ISO/IEC 29100 sets out unlinkability, transparency and intervenability as privacy safeguarding requirements that complement the traditional information security goals. ISO/IEC 27701 uses the ISO/IEC 29100 vocabulary for PII roles and principles.

Question 26Fundamental principles and concepts of a privacy information management system

In ISO/IEC 27701, what does the term "PII principal" designate?

  1. The individual to whom the PII relates Correct answer.
  2. The entity that determines the purposes and means of processing PII
  3. A supervisory body that oversees compliance with privacy regulation
  4. A supplier that handles PII on another organization's behalf

Explanation

ISO/IEC 27701 builds on the ISO/IEC 29100 vocabulary, in which the PII principal is the person to whom the PII relates. The standard deliberately uses this neutral term instead of jurisdiction-specific words such as "data subject", so its requirements read the same across legal regimes. The other parties named in the options are defined separately as the PII controller, a regulator, and a PII processor.

Question 27Fundamental principles and concepts of a privacy information management system

Which statement about the applicability of ISO/IEC 27701 is correct?

  1. It applies only to organizations whose workforce exceeds a threshold defined in the standard.
  2. It applies only to organizations that process PII using cloud-based or outsourced infrastructure.
  3. It applies only to organizations that already hold ISO/IEC 27001 certification following a completed certification audit.
  4. It applies to any organization that processes PII, whatever its size or sector. Correct answer.

Explanation

ISO/IEC 27701 is a generic extension to ISO/IEC 27001 and ISO/IEC 27002 and is intended for use by organizations of all types and sizes that process PII. How much documentation and which controls are applied depends on the organization's context, scope and risk assessment, not on headcount or technology choice. It does not require prior certification to ISO/IEC 27001, although the PIMS requirements assume an information security management system is in place.

Question 28Fundamental principles and concepts of a privacy information management system

An online retailer's checkout form requires every customer to supply a landline telephone number, although orders are confirmed by email and the number is never used. Which Annex A control objective does this most directly conflict with?

  1. Limiting PII collection to what the stated purposes require Correct answer.
  2. Keeping PII accurate, complete and up to date for its purpose
  3. Giving PII principals a copy of their PII when they ask for it
  4. Protecting PII while it is transmitted over public networks

Explanation

Annex A contains a control objective on the conditions for collection and processing, one element of which is that collection is confined to what is necessary in relation to the identified purposes. A mandatory field that serves no stated purpose and is never used is collection beyond that limit. Accuracy, access requests and transmission security address different concerns and are not engaged by over-collection.

Question 29Fundamental principles and concepts of a privacy information management system

A marketing team's database records only a "yes" flag against each contact, with no record of when consent was given, what wording the individual saw, or which channel was chosen. Which ISO/IEC 27701 expectation is most directly unmet?

  1. Consent records must be held in the same system that sends the messages.
  2. The organization must be able to demonstrate that valid consent was obtained. Correct answer.
  3. Consent must be confirmed by an independent third party before use.
  4. Consent must be renewed at fixed intervals defined by the standard.

Explanation

The Annex A controls for PII controllers address obtaining and recording consent, so that the organization can show it holds a valid basis for the processing. Evidence typically covers when consent was given, how it was captured and to what the individual agreed, which a bare flag cannot provide. The standard does not impose a fixed renewal period, a prescribed storage location, or external verification.

Question 30Privacy information management system requirements

What is the primary purpose of ISO/IEC 27701 within an organization's management system framework?

  1. To prescribe financial reporting controls for organizations that process personal data.
  2. To certify privacy-enhancing software products for global markets.
  3. To provide requirements and guidance for a privacy information management system. Correct answer.
  4. To replace ISO/IEC 27001 with a separate privacy certification scheme.

Explanation

ISO/IEC 27701 specifies PIMS-specific requirements and guidance that extend ISO/IEC 27001 and ISO/IEC 27002 for organizations acting as PII controllers or processors. It is not a replacement for ISO/IEC 27001 and does not certify products.

Question 31Privacy information management system requirements

In ISO/IEC 27701, which clause contains the PIMS-specific requirements related to ISO/IEC 27001?

  1. Clause 4
  2. Clause 7
  3. Clause 5 Correct answer.
  4. Clause 6

Explanation

Clause 5 contains PIMS-specific requirements related to ISO/IEC 27001, while clauses 6, 7 and 8 contain PIMS-specific guidance and additional guidance for controllers and processors. Clause 4 describes the structure and application of the standard.

Question 32Privacy information management system requirements

Which action best demonstrates top management leadership and commitment to the PIMS?

  1. Limiting privacy awareness training to members of the legal department.
  2. Delegating all privacy-related decisions to the IT service desk team.
  3. Approving the privacy policy and integrating PIMS into processes. Correct answer.
  4. Outsourcing the entire privacy management system to an external law firm.

Explanation

Top management must demonstrate leadership by ensuring the PIMS is integrated into business processes, providing resources, communicating importance and promoting improvement. Approving the privacy policy and integrating requirements into processes are direct expressions of that commitment.

Question 33Privacy information management system requirements

To whom must the organization make its privacy policy available?

  1. Only to the board of directors.
  2. To interested parties, as appropriate. Correct answer.
  3. Only to employees who have access to PII.
  4. Only to regulators upon a formal written request.

Explanation

The privacy policy must be documented, communicated within the organization and made available to interested parties as appropriate. Interested parties can include data subjects, customers and regulators, depending on the context.

Question 34Privacy information management system requirements

A privacy manager reviews new data protection legislation in a country where the organization sells products. This review is part of which PIMS context activity?

  1. Drafting the statement of applicability.
  2. Determining external issues relevant to the PIMS. Correct answer.
  3. Selecting the members of the internal audit team.
  4. Calculating the budget for privacy software.

Explanation

Determining the context of the organization includes identifying external issues such as legal, regulatory, market, technological and social factors. Reviewing new legislation is therefore part of determining external issues relevant to the PIMS.

Question 35Privacy information management system requirements

An organization identifies customers, employees, regulators and third-party processors as parties with an interest in its PII processing. What should the organization determine about these interested parties?

  1. Their relevant PII protection requirements and expectations. Correct answer.
  2. Their preferred software vendors and current licensing arrangements.
  3. Their financial credit ratings and historical payment records.
  4. Their internal audit schedules and allocated staff resources.

Explanation

The organization must determine the interested parties relevant to the PIMS and their relevant requirements and expectations. These requirements can include legal, regulatory, contractual and societal expectations related to PII protection.

Question 36Privacy information management system requirements

Which factor must be reflected in the scope of the PIMS?

  1. The PII processing activities, units, locations and systems in scope. Correct answer.
  2. Only systems managed directly by the privacy office team.
  3. Only activities performed by permanent employees, excluding contractors.
  4. Only the organization's headquarters location and primary office.

Explanation

The PIMS scope defines the boundaries and applicability of the management system and must reflect the PII processing activities, organizational units, locations and systems covered. Interfaces and dependencies with third parties should also be considered where relevant.

Question 37Privacy information management system requirements

What is the main purpose of the PII protection risk assessment in the PIMS?

  1. To identify, analyze and evaluate PII processing risks. Correct answer.
  2. To calculate the organization's annual tax liability.
  3. To replace the information security risk assessment entirely.
  4. To certify that no privacy incidents can occur.

Explanation

The PII protection risk assessment identifies, analyzes and evaluates risks related to PII processing, considering harm to PII principals and to the organization. Its results drive risk treatment and the selection of controls.

Question 38Privacy information management system requirements

Before performing PII protection risk assessments, what must the organization establish?

  1. Risk acceptance criteria and assessment criteria. Correct answer.
  2. The names of all data subjects involved.
  3. A list of approved software vendors only.
  4. The final internal audit report.

Explanation

The organization must establish risk criteria that include risk acceptance criteria and criteria for performing PII protection risk assessments. These criteria provide a consistent basis for identifying, analyzing and evaluating risks.

Question 39Privacy information management system requirements

Which document identifies the controls selected to treat PII protection risks and justifies inclusions and exclusions?

  1. The service level agreement.
  2. The data subject request log.
  3. The statement of applicability. Correct answer.
  4. The business continuity plan.

Explanation

The statement of applicability identifies the controls selected and provides justification for inclusion or exclusion, linked to risk treatment. It is a key documented output of PIMS planning.

Question 40Privacy information management system requirements

How should PII protection responsibilities be handled in the PIMS?

  1. They should be assigned only to external auditors.
  2. They should be limited to the chief executive officer.
  3. They should remain undocumented to preserve operational flexibility.
  4. They should be assigned and communicated at relevant levels. Correct answer.

Explanation

Top management must ensure that roles, responsibilities and authorities for PII protection are assigned and communicated at relevant levels. Clear accountability supports effective operation of the PIMS.

Question 41Privacy information management system requirements

When planning the PIMS, what must the organization do with the issues and requirements identified in its context?

  1. Determine risks and opportunities to be addressed. Correct answer.
  2. Ignore them if they are not financial in nature.
  3. Delegate them to the IT help desk for action.
  4. Publish them on the corporate website for transparency.

Explanation

Planning requires the organization to consider its context and interested-party requirements and determine the risks and opportunities that need to be addressed. This supports intended outcomes, prevention of undesired effects and continual improvement.

Question 42Privacy information management system requirements

What should the organization determine when addressing competence for PIMS roles?

  1. The number of social media followers the organization has globally.
  2. Only the age of each employee.
  3. The competence needed for work affecting PII protection performance. Correct answer.
  4. The preferred office location of each employee.

Explanation

The organization must determine the necessary competence of persons doing work under its control that affects PII protection performance. It must ensure those persons are competent and retain appropriate documented evidence.

Question 43Privacy information management system requirements

Which topic must persons doing work under the organization's control be aware of?

  1. The marketing strategy for future product launches and campaigns.
  2. The personal home addresses of all employees and contractors.
  3. The privacy policy and their contribution to the PIMS. Correct answer.
  4. The salaries of the executive team and other senior managers.

Explanation

Awareness requirements include the privacy policy, the individual's contribution to PIMS effectiveness and the implications of not conforming with PIMS requirements. This applies to persons working under the organization's control.

Question 44Privacy information management system requirements

What must the organization determine regarding PIMS communication?

  1. What, when, with whom and how to communicate. Correct answer.
  2. Only the color scheme for privacy awareness posters.
  3. Only the budget allocated for privacy tools.
  4. Only the name of the external auditor.

Explanation

The organization must determine what to communicate, when, with whom and how, relevant to the PIMS. This includes internal and external communications affecting PII protection.

Question 45Privacy information management system requirements

Which documented information must be controlled under the PIMS?

  1. Only email messages sent by the privacy officer to employees.
  2. Information required by the standard and needed for the PIMS. Correct answer.
  3. Only documents that are stored in paper format in the office.
  4. Only documents that are required by external regulatory authorities.

Explanation

Documented information includes that required by ISO/IEC 27701 and ISO/IEC 27001 and that the organization determines as necessary for PIMS effectiveness. Control applies regardless of format or medium.

Question 46Privacy information management system requirements

During operation, an organization plans to change a PII processing system. What must it do to maintain control?

  1. Proceed without review because changes are purely operational.
  2. Notify only the marketing department about the change.
  3. Disable all privacy controls until the change is complete.
  4. Review the consequences of unintended changes and take mitigating action. Correct answer.

Explanation

Operation requires planning and controlling processes and reviewing the consequences of unintended changes. Changes affecting PII processing should be assessed and mitigating action taken where needed.

Question 47Privacy information management system requirements

What should the organization monitor and measure as part of PIMS performance evaluation?

  1. Only employee satisfaction with office facilities.
  2. Only the number of incidents reported to the media.
  3. Only the number of website visits per month.
  4. PII protection performance and PIMS effectiveness. Correct answer.

Explanation

Performance evaluation requires monitoring, measurement, analysis and evaluation of PII protection performance and PIMS effectiveness. The organization determines suitable methods and timing.

Question 48Privacy information management system requirements

When planning the internal audit programme, what should the organization consider?

  1. The importance of processes and results of previous audits. Correct answer.
  2. Only the size of the marketing budget.
  3. Only the number of employees working in the legal department.
  4. Only the availability of the auditor's calendar.

Explanation

The audit programme must consider the importance of the processes concerned, changes affecting the organization and the results of previous audits. This helps focus audit effort where it matters most.

Question 49Privacy information management system requirements

Which input is most relevant to top management's review of the PIMS?

  1. The number of office parking spaces available.
  2. Feedback on PII protection performance and audit results. Correct answer.
  3. The color of the privacy policy binder.
  4. The personal hobbies of the chief executive officer.

Explanation

Management review inputs include feedback on PII protection performance, nonconformities, audit results, risk assessment status and changes in context. These enable top management to evaluate the PIMS and direct improvement.

Question 50Privacy information management system requirements

When a PIMS nonconformity is detected, what should the organization do first?

  1. Ignore it if no PII was disclosed to any external party.
  2. Delete all records related to the nonconformity.
  3. React to the nonconformity and take corrective action. Correct answer.
  4. Wait for the next annual audit cycle.

Explanation

The organization must react to the nonconformity and take action to control and correct it. It then evaluates the need to eliminate the cause, implements corrective action, reviews effectiveness and updates risks if necessary.