I85PREP
⌘ K
ISO 27701 LI study materials
ISO 27701 LI study resources

ISO 27701 LI practice questions

One question at a time. Build your ISO 27701 LI understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Fundamental principles and concepts of a privacy information management system

In ISO/IEC 27701, what is the primary purpose of a privacy information management system (PIMS)?

  1. To replace national data protection legislation with an international standard
  2. To define the technical encryption algorithms required for personal data
  3. To manage privacy risks and obligations related to personally identifiable information within an organization's management system Correct answer.
  4. To certify that an organization's products are free of security vulnerabilities

Explanation

A PIMS extends an existing management system so that privacy-specific requirements, risks and obligations for personally identifiable information are managed systematically. ISO/IEC 27701 provides requirements and guidance for establishing, implementing, maintaining and continually improving that extension. It does not itself certify products or override applicable law.

Question 2Fundamental principles and concepts of a privacy information management system

ISO/IEC 27701 is designed to be used as an extension to which pair of management system standards?

  1. ISO 31000 and ISO 45001
  2. ISO 9001 and ISO 14001
  3. ISO/IEC 20000 and ISO 22301
  4. ISO/IEC 27001 and ISO/IEC 27002 Correct answer.

Explanation

The standard is structured as an extension to ISO/IEC 27001 (information security management system requirements) and ISO/IEC 27002 (information security controls). This lets organizations add privacy-specific requirements and guidance onto an existing ISMS rather than building a separate system. The other pairs cover quality, environment, service management, continuity, risk and occupational health.

Question 3Fundamental principles and concepts of a privacy information management system

Within a PIMS, what does the term 'personally identifiable information' (PII) refer to?

  1. Aggregated statistics that cannot be linked to a person
  2. Only data collected through website cookies
  3. Information that can be used to identify an individual, directly or indirectly Correct answer.
  4. Any data that has been encrypted at rest

Explanation

PII is defined broadly as information relating to an identified or identifiable individual, whether the identification is direct or indirect. The concept is technology-neutral and does not depend on storage format or collection channel. Aggregated or truly anonymized data falls outside this definition.

Question 4Fundamental principles and concepts of a privacy information management system

In the structure of ISO/IEC 27701, which entity does the 'PII controller' role describe?

  1. A supervisory authority that enforces privacy law
  2. A party that processes PII on behalf of another organization
  3. A supplier that only stores backup copies of data
  4. A party that determines the purposes and means of processing PII Correct answer.

Explanation

The PII controller is the entity that alone or jointly with others determines the purposes and means of processing PII. This mirrors the controller concept used in many privacy regimes. A processor, by contrast, handles PII on the controller's behalf.

Question 5Fundamental principles and concepts of a privacy information management system

An organization already certified to ISO/IEC 27001 wants to add a PIMS. What does ISO/IEC 27701 require regarding the underlying ISMS?

  1. The ISMS certification must be suspended during PIMS implementation
  2. A separate independent management system must be built with no overlap
  3. The ISMS must be replaced by a standalone privacy standard
  4. The PIMS requirements are implemented as an extension of the existing ISMS Correct answer.

Explanation

ISO/IEC 27701 is applied as an extension to the ISMS, adding privacy-specific requirements and guidance to the existing structure. Organizations are not expected to abandon or duplicate their ISMS. The common management-system clauses support integration rather than replacement.

Question 6Fundamental principles and concepts of a privacy information management system

Which statement best distinguishes the roles of ISO/IEC 27001 and ISO/IEC 27701 in an integrated management system?

  1. Both standards address only privacy and contain no security requirements
  2. 27001 sets information security requirements; 27701 adds privacy-specific requirements and guidance for PII Correct answer.
  3. Both standards are identical and differ only in publication year
  4. 27701 sets information security requirements; 27001 adds privacy-specific guidance

Explanation

ISO/IEC 27001 provides the information security management system requirements, while ISO/IEC 27701 extends that foundation with privacy-specific requirements and guidance for PII protection. The two are complementary, with the privacy standard building on the security one. They are not interchangeable or identical.

Question 7Fundamental principles and concepts of a privacy information management system

Under the ISO/IEC 27701 framework, which activity is characteristic of a PII processor rather than a PII controller?

  1. Processing PII strictly on the documented instructions of a controller Correct answer.
  2. Deciding to launch a new marketing campaign using customer data
  3. Determining which categories of PII will be collected
  4. Setting the retention period based on business strategy

Explanation

A processor processes PII on behalf of and according to the instructions of a controller. Decisions about purposes, data categories and retention strategy rest with the controller. This division of responsibility underpins the separate control sets in ISO/IEC 27701.

Question 8Fundamental principles and concepts of a privacy information management system

A company wants to demonstrate conformance of its privacy practices to ISO/IEC 27701. Which statement accurately reflects how the standard is used for this purpose?

  1. The standard issues privacy seals directly to individual products
  2. The standard can be used as a basis for independent certification of the PIMS Correct answer.
  3. The standard automatically grants legal compliance with every jurisdiction
  4. The standard replaces the need for internal audits

Explanation

ISO/IEC 27701 is written so that it can be used as a basis for independent certification of a PIMS, in conjunction with the underlying ISMS. Certification demonstrates conformance with the standard, not automatic legal compliance in every jurisdiction. Internal audit remains a required management-system activity.

Question 9Fundamental principles and concepts of a privacy information management system

Which concept describes the principle that PII should be collected only for specified, explicit and legitimate purposes and not used incompatibly?

  1. Storage limitation
  2. Purpose limitation Correct answer.
  3. Data minimization
  4. Integrity and confidentiality

Explanation

Purpose limitation means PII is collected for specified, explicit and legitimate purposes and is not further processed in a manner incompatible with those purposes. Data minimization concerns collecting only what is necessary, while storage limitation concerns retention periods. These are distinct privacy principles.

Question 10Fundamental principles and concepts of a privacy information management system

In ISO/IEC 27701 terminology, what does 'de-identification' aim to achieve?

  1. Permanently encrypting all PII with a single shared key
  2. Copying PII into a second database for resilience
  3. Publishing PII openly to demonstrate transparency
  4. Reducing the linkability of PII to an individual so that identification is prevented or reduced Correct answer.

Explanation

De-identification reduces the association between PII and the individual so that identification is prevented or significantly reduced. It is a privacy-protective technique distinct from encryption or backup. The goal is to lower re-identification risk, not to publish or duplicate data.

Question 11Fundamental principles and concepts of a privacy information management system

A privacy manager is mapping the ISO/IEC 27701 control clauses to organizational roles. Which pairing correctly reflects the standard's structure?

  1. Controls apply only to processors because controllers are unregulated
  2. One set of guidance applies to PII controllers and another to PII processors Correct answer.
  3. A single identical control set applies to all parties with no role distinction
  4. Controls apply only to public-sector organizations

Explanation

ISO/IEC 27701 provides separate guidance for PII controllers and PII processors, reflecting their different responsibilities. This role-based structure lets each type of organization apply the controls relevant to its position. It is not limited to any single sector.

Question 12Fundamental principles and concepts of a privacy information management system

Which of the following best describes 'privacy by design' as reflected in a PIMS?

  1. Relying solely on user consent to address every privacy risk
  2. Adding privacy documentation after a system has been deployed
  3. Embedding privacy protections into systems and processes from the outset Correct answer.
  4. Outsourcing all privacy decisions to a third-party auditor

Explanation

Privacy by design means privacy protections are integrated into systems, processes and products from the beginning rather than added afterward. It treats privacy as a design requirement alongside functional requirements. Documentation or consent alone does not substitute for embedded protections.

Question 13Fundamental principles and concepts of a privacy information management system

Which statement about the relationship between a PIMS and an organization's overall risk management is most accurate?

  1. Privacy risk treatment is limited to purchasing insurance
  2. Privacy risks are managed only by the legal department outside the PIMS
  3. Privacy risks are assessed and treated within the management system's risk processes Correct answer.
  4. Privacy risks are irrelevant once an ISMS is certified

Explanation

A PIMS integrates privacy risk assessment and treatment into the management system's risk processes, extending the ISMS approach to PII-specific risks. Certification of an ISMS does not eliminate privacy risk. Treating privacy risk as an isolated legal or insurance matter falls short of a systematic PIMS.

Question 14Fundamental principles and concepts of a privacy information management system

What is the role of top management in a PIMS according to management-system principles?

  1. Restricting privacy policy communication to external parties
  2. Providing leadership and demonstrating commitment to the PIMS Correct answer.
  3. Approving only the annual budget with no privacy involvement
  4. Delegating all privacy responsibilities to the IT helpdesk

Explanation

Top management must provide leadership and demonstrate commitment, for example by establishing policy and ensuring resources and responsibilities are assigned. Leadership is a core management-system principle that underpins the PIMS. Delegating everything to support staff or limiting communication undermines the system.

Question 15Fundamental principles and concepts of a privacy information management system

An organization processes PII for several clients and also determines how some PII is used for its own purposes. How should it approach ISO/IEC 27701 guidance?

  1. Apply only processor guidance because most activity is for clients
  2. Choose whichever single set is less burdensome
  3. Apply only controller guidance because it holds the data
  4. Apply both controller and processor guidance to the respective activities Correct answer.

Explanation

An organization can act as both controller and processor for different processing activities, so it should apply the relevant guidance to each. ISO/IEC 27701 separates the two control sets precisely to support this. Selecting only one set would leave part of the processing unaddressed.

Question 16Fundamental principles and concepts of a privacy information management system

Which statement correctly characterizes the term 'PII principal' in ISO/IEC 27701?

  1. The regulator that licenses the organization
  2. The auditor who reviews the PIMS
  3. The software system that stores PII
  4. The individual to whom PII relates Correct answer.

Explanation

The PII principal is the individual to whom the PII relates, corresponding to the data subject in many privacy regimes. The term keeps the standard technology- and jurisdiction-neutral. Auditors, systems and regulators are distinct roles.

Question 17Fundamental principles and concepts of a privacy information management system

Which of the following is the best example of applying the data minimization principle in a PIMS?

  1. Retaining all PII indefinitely to support future analytics
  2. Collecting only the PII necessary to fulfil the stated purpose Correct answer.
  3. Collecting every available field in case it becomes useful later
  4. Sharing PII broadly to increase transparency

Explanation

Data minimization requires collecting only the PII that is necessary for the specified purpose. Collecting extra fields speculatively or retaining data indefinitely conflicts with this principle. Broad sharing also increases exposure rather than minimizing data.

Question 18Fundamental principles and concepts of a privacy information management system

What does the principle of 'accountability' require of an organization operating a PIMS?

  1. Being able to demonstrate compliance with privacy requirements and obligations Correct answer.
  2. Avoiding any documentation of privacy decisions
  3. Relying on verbal assurances without records
  4. Transferring all liability to individual employees

Explanation

Accountability requires the organization to be able to demonstrate that it complies with applicable privacy requirements and its own policies. This typically involves documented decisions, records and evidence within the PIMS. Shifting liability to employees or avoiding records undermines accountability.

Question 19Fundamental principles and concepts of a privacy information management system

Which activity best illustrates 'privacy impact assessment' within a PIMS?

  1. Purchasing additional server capacity
  2. Renewing the ISMS certificate each year
  3. Counting the number of employees in the privacy team
  4. Reviewing a new system's PII processing to identify and mitigate privacy risks before launch Correct answer.

Explanation

A privacy impact assessment examines a new or changed processing activity to identify and mitigate privacy risks before it goes live. It is a proactive risk tool embedded in the PIMS. Staff counts, certificate renewal and capacity purchases are unrelated operational tasks.

Question 20Fundamental principles and concepts of a privacy information management system

Which statement about the scope of a PIMS is most consistent with ISO/IEC 27701?

  1. Scope must cover all PII processing the organization performs or that is performed on its behalf Correct answer.
  2. Scope must cover only paper records
  3. Scope is fixed by the certification body and cannot be defined by the organization
  4. Scope need not be documented

Explanation

The PIMS scope should encompass the PII processing activities the organization carries out or that are performed on its behalf, and it must be documented. The organization defines the scope, which the certification body then assesses. Restricting scope to paper records would be arbitrary and incomplete.

Question 21Fundamental principles and concepts of a privacy information management system

An organization receives a request from a PII principal to access their data. Which PIMS concept does this primarily engage?

  1. PII principal rights Correct answer.
  2. Network perimeter security
  3. Change management
  4. Supplier onboarding

Explanation

Handling access and similar requests engages the PII principal rights concept, which addresses enabling individuals to exercise rights over their PII. The PIMS should include processes to receive and respond to such requests. Perimeter security, change management and supplier onboarding are different domains.

Question 22Fundamental principles and concepts of a privacy information management system

Which statement best captures why ISO/IEC 27701 uses neutral terminology such as 'PII controller' rather than jurisdiction-specific legal terms?

  1. To make the standard applicable across different legal frameworks and regions Correct answer.
  2. To replace the need for legal advice entirely
  3. To avoid defining any responsibilities at all
  4. To limit the standard to a single country

Explanation

Neutral terminology lets the standard be applied across jurisdictions whose legal terms differ, while preserving the underlying roles and responsibilities. It does not remove the need for organizations to interpret applicable law. The standard remains globally applicable rather than tied to one country.

Question 23Fundamental principles and concepts of a privacy information management system

How does the concept of 'continual improvement' apply to a PIMS?

  1. The PIMS is frozen after initial certification
  2. Improvements are limited to purchasing new software
  3. Privacy controls are reviewed and enhanced over time based on performance and changing risks Correct answer.
  4. Privacy performance is never measured

Explanation

Continual improvement means the PIMS is regularly reviewed and enhanced using performance data, audit results and evolving risks. Management-system standards expect ongoing improvement rather than a one-time setup. This is not limited to tooling purchases and requires measurement.

Question 24Fundamental principles and concepts of a privacy information management system

Which pairing of concept and description is correct for ISO/IEC 27701 fundamentals?

  1. PIMS - a software product sold to consumers
  2. PII principal - the organization that stores the data
  3. PII controller - determines the purposes and means of processing Correct answer.
  4. PII processor - determines the purposes and means of processing

Explanation

The PII controller determines the purposes and means of processing, while the processor acts on the controller's instructions. The PII principal is the individual concerned, and the PIMS is a management system rather than a consumer product. Correctly pairing roles with descriptions is foundational to applying the standard.

Question 25Fundamental principles and concepts of a privacy information management system

Why does ISO/IEC 27701 emphasize documented information within the PIMS?

  1. To provide evidence that requirements are met and to support consistent operation Correct answer.
  2. To prevent any future changes to the system
  3. To increase the volume of paperwork for its own sake
  4. To replace the need for management review

Explanation

Documented information provides evidence of conformity and supports consistent, repeatable operation of the PIMS. It also underpins accountability and audit. Documentation is not an end in itself and does not replace management review or prevent improvement.

Question 26Fundamental principles and concepts of a privacy information management system

In ISO/IEC 27701, which term is defined as the natural person to whom the personally identifiable information relates?

  1. PII principal Correct answer.
  2. PII processor
  3. PII custodian
  4. PII controller

Explanation

ISO/IEC 27701 defines 'PII principal' as the natural person to whom the personally identifiable information relates. This term is used instead of jurisdiction-specific terms like 'data subject' to keep the standard neutral. The PII controller and PII processor are organizational roles, not the individual.

Question 27Fundamental principles and concepts of a privacy information management system

An organization is establishing a PIMS and wants to ensure its privacy controls are integrated with its existing information security management system. According to ISO/IEC 27701, what is the primary relationship between the PIMS and the ISMS?

  1. The PIMS is a certification scheme that is independent of the ISMS and focuses only on legal compliance.
  2. The PIMS is a set of privacy guidelines that organizations may adopt without implementing an ISMS.
  3. The PIMS extends the ISMS by adding privacy-specific requirements and controls that build on the ISMS framework. Correct answer.
  4. The PIMS is a standalone management system that replaces the ISMS for privacy-related controls.

Explanation

ISO/IEC 27701 is designed as an extension to ISO/IEC 27001 and ISO/IEC 27002, adding privacy-specific requirements and controls. It does not replace the ISMS but builds on its structure and risk management approach. Organizations typically implement a PIMS as an extension of their existing ISMS.

Question 28Fundamental principles and concepts of a privacy information management system

A PII controller is reviewing its privacy program and wants to demonstrate accountability under ISO/IEC 27701. Which action best exemplifies the principle of accountability in a PIMS?

  1. Implementing technical security controls such as encryption and access management.
  2. Assigning privacy responsibilities to a dedicated role and maintaining records of processing activities. Correct answer.
  3. Conducting a one-time privacy training session for all employees at the start of the year.
  4. Publishing a privacy notice on the organization's website that describes its data practices.

Explanation

Accountability in a PIMS requires the organization to assign responsibilities and maintain documented information, such as records of processing activities, to demonstrate compliance. This ongoing governance structure shows that the organization takes responsibility for its PII processing. A one-time training, a privacy notice, or technical controls alone do not fully demonstrate accountability.

Question 29Fundamental principles and concepts of a privacy information management system

An organization is defining the scope of its PIMS. It processes PII for its own marketing purposes and also handles PII on behalf of several client organizations. How should the PIMS scope be described to align with ISO/IEC 27701?

  1. The scope should cover only the PII processed on behalf of clients, because that represents the majority of processing activities.
  2. The scope should be limited to the organization's headquarters location, regardless of where PII processing occurs.
  3. The scope should cover only the PII processed for the organization's own marketing purposes, as that is the primary business activity.
  4. The scope should cover all PII processing activities, clearly identifying the organization's roles as both PII controller and PII processor. Correct answer.

Explanation

ISO/IEC 27701 requires organizations to define the scope of the PIMS and to identify their roles as PII controller and/or PII processor for the processing activities within that scope. When an organization acts in both roles, the scope should encompass all relevant processing and clearly state each role. Limiting the scope to one role or one location would not reflect the actual processing and would weaken the PIMS.

Question 30Initiation of the PIMS implementation

Under ISO/IEC 27701, what is the primary purpose of the Privacy Information Management System (PIMS) that an organization extends from its existing ISMS?

  1. To define financial accounting controls for public companies
  2. To certify the security of network perimeter devices
  3. To replace all national data protection legislation
  4. To provide a framework for managing privacy risks related to personally identifiable information (PII) Correct answer.

Explanation

A PIMS is a management system that extends the ISMS to address privacy-specific requirements for PII processing. It helps the organization manage privacy risk and demonstrate accountability to regulators and customers. It does not replace legal obligations or certify individual devices.

Question 31Initiation of the PIMS implementation

Which two roles does ISO/IEC 27701 use to distinguish organizations when scoping a PIMS?

  1. Network operator and service desk
  2. PII controller and PII processor Correct answer.
  3. Data broker and data custodian
  4. Internal auditor and external auditor

Explanation

ISO/IEC 27701 separates requirements for organizations acting as PII controllers and those acting as PII processors. The applicable control sets depend on which role the organization plays for a given processing activity. Many organizations act in both roles across different services.

Question 32Initiation of the PIMS implementation

An organization is beginning PIMS implementation and already holds ISO/IEC 27001 certification. What is the recommended starting point for the privacy extension?

  1. Suspend the ISMS until the PIMS is fully certified
  2. Outsource all PII processing to a third party
  3. Build a separate privacy management system with no link to the ISMS
  4. Use the existing ISMS processes and add the ISO/IEC 27701 privacy-specific requirements Correct answer.

Explanation

ISO/IEC 27701 is designed as an extension to ISO/IEC 27001, so the existing ISMS structures, risk processes and documentation are reused. The organization adds the privacy-specific requirements and guidance on top of that foundation. Starting from scratch duplicates effort and creates inconsistency.

Question 33Initiation of the PIMS implementation

During PIMS initiation, why must top management be involved in establishing the privacy policy and assigning roles?

  1. Because management must personally process all PII requests
  2. Because it removes the need for documented procedures
  3. Because leadership commitment provides authority, resources and accountability for the PIMS Correct answer.
  4. Because only executives are permitted to read the standard

Explanation

Leadership commitment is a core management system requirement that gives the PIMS authority, budget and direction. Top management establishes the policy and ensures responsibilities are assigned and understood. This accountability cannot be delegated away entirely.

Question 34Initiation of the PIMS implementation

When defining the scope of a PIMS, which element must the organization identify?

  1. The payroll grade of the privacy officer
  2. The organizational units, locations and processing activities involving PII Correct answer.
  3. The marketing budget for the coming year
  4. The names of all competitors holding similar data

Explanation

Scope definition requires identifying which parts of the organization, physical locations, systems and processing activities are covered by the PIMS. Interfaces and dependencies with third parties also need to be considered. Scope drives which controls and legal obligations apply.

Question 35Initiation of the PIMS implementation

What is the role of a privacy risk assessment during the initiation of a PIMS?

  1. It determines the organization's credit rating
  2. It measures employee satisfaction with IT services
  3. It replaces the need for a legal register
  4. It identifies and evaluates risks to PII and to PII principals so controls can be selected Correct answer.

Explanation

The privacy risk assessment links identified threats and vulnerabilities affecting PII to the selection of appropriate controls. It considers impact on individuals as well as on the organization. Its outputs feed the risk treatment plan and the Statement of Applicability.

Question 36Initiation of the PIMS implementation

Which document records the organization's justification for including or excluding each applicable ISO/IEC 27701 control?

  1. The training calendar
  2. The Statement of Applicability Correct answer.
  3. The business continuity plan
  4. The asset register

Explanation

The Statement of Applicability lists the applicable controls and records justification for inclusion or exclusion, along with implementation status. It is a key artifact carried over from the ISMS and extended for privacy controls. Auditors use it to verify that control decisions are deliberate.

Question 37Initiation of the PIMS implementation

Why does ISO/IEC 27701 require the organization to determine and document its applicable legal and regulatory privacy obligations early in implementation?

  1. Because regulators write the organization's risk treatment plan
  2. Because laws never change and can be documented once
  3. Because legal obligations only apply after certification
  4. Because those obligations shape the controls, records and risk criteria the PIMS must address Correct answer.

Explanation

Legal and regulatory obligations define what the PIMS must achieve in each jurisdiction where PII is processed. They inform risk criteria, retention rules, breach notification duties and individual rights handling. Identifying them early prevents controls from being designed against an incomplete picture.

Question 38Initiation of the PIMS implementation

A retail company processes customer data as a controller and also hosts loyalty program data for partner brands as a processor. How should it structure its PIMS scope?

  1. Cover only the controller activities and ignore processor duties
  2. Exclude the loyalty program because it involves third parties
  3. Cover both controller and processor activities, applying the corresponding control sets to each Correct answer.
  4. Defer all processor activities to the partner brands' PIMS

Explanation

When an organization acts in both roles, the PIMS scope should cover both, and the controller and processor control sets apply to the respective activities. Mapping activities to roles determines which requirements are relevant. Ignoring one role leaves a compliance gap.

Question 39Initiation of the PIMS implementation

What is the most appropriate way to establish privacy roles and responsibilities at the start of a PIMS implementation?

  1. Assign all privacy duties informally to whoever is available
  2. Define documented roles such as a privacy officer with clear authority and reporting lines Correct answer.
  3. Rely on the IT helpdesk to interpret privacy law
  4. Let each department invent its own uncoordinated approach

Explanation

Clear, documented roles with defined authority ensure privacy responsibilities are understood and consistently executed. A designated privacy lead coordinates across functions and reports to management. Informal or fragmented assignment creates gaps and unclear accountability.

Question 40Initiation of the PIMS implementation

An organization wants to integrate privacy into its existing ISO/IEC 27001 risk process. Which approach best reflects ISO/IEC 27701 guidance?

  1. Assess only risks to the organization's reputation
  2. Run a completely separate risk methodology with different scales and owners
  3. Extend the existing risk methodology to explicitly assess risks to PII principals alongside organizational risks Correct answer.
  4. Skip risk assessment because the ISMS already covers information security

Explanation

ISO/IEC 27701 expects privacy risks, including risks to individuals, to be assessed within the management system. Extending the existing methodology keeps the process coherent and avoids duplicated governance. The assessment must explicitly consider harm to PII principals.

Question 41Initiation of the PIMS implementation

During initiation, a team maps PII flows and discovers that customer data is transferred to a cloud provider in another country. What should the PIMS scope and risk work capture about this?

  1. The transfer, the provider's role, and the applicable cross-border transfer obligations and risks Correct answer.
  2. Only the local storage location
  3. Only the provider's marketing materials
  4. Nothing, because the provider is a separate company

Explanation

PII flow mapping must include transfers to third parties and across borders, because these introduce specific legal obligations and risks. The provider's role as processor or sub-processor should be documented. These findings feed both the scope and the risk assessment.

Question 42Initiation of the PIMS implementation

Which input is most useful for determining the applicable privacy controls when initiating a PIMS?

  1. The organization's PII processing register combined with its legal obligations Correct answer.
  2. The results of a staff engagement survey
  3. The office floor plan
  4. A competitor's annual report

Explanation

The processing register identifies what PII is processed, why and by whom, while legal obligations determine what must be achieved. Together they allow the organization to select relevant ISO/IEC 27701 controls. Neither input alone gives a complete basis for control selection.

Question 43Initiation of the PIMS implementation

An organization is defining PIMS objectives. Which set of objectives is most aligned with ISO/IEC 27701?

  1. Reduce headcount in the legal department
  2. Increase the number of third-party data shares
  3. Ensure lawful and transparent PII processing, protect PII principals, and meet obligations Correct answer.
  4. Maximize advertising reach and minimize legal review

Explanation

PIMS objectives should reflect lawful, fair and transparent processing, protection of individuals and fulfilment of obligations. They must be measurable and consistent with the privacy policy. Objectives focused on expansion at the expense of compliance contradict the PIMS purpose.

Question 44Initiation of the PIMS implementation

What is the purpose of establishing a documented privacy policy at the start of PIMS implementation?

  1. To describe the company's product roadmap
  2. To list every employee's home address
  3. To replace the need for any operational procedures
  4. To state the organization's commitments and principles for PII processing and provide direction for controls Correct answer.

Explanation

The privacy policy communicates top-level commitments and principles that guide how PII is handled. It provides a reference point for procedures, controls and objectives. It is a framework document and does not replace detailed operational procedures.

Question 45Initiation of the PIMS implementation

A newly appointed privacy officer is building the PIMS team. Which combination of competencies is most relevant to the initiation phase?

  1. Only graphic design skills
  2. Only software coding skills
  3. Privacy law knowledge, risk management, information security and process documentation skills Correct answer.
  4. Only sales negotiation skills

Explanation

PIMS initiation requires understanding of privacy obligations, risk assessment, security controls and the ability to document processes. A mix of legal, risk and technical competence supports scoping, assessment and control design. A single narrow skill set will leave gaps.

Question 46Initiation of the PIMS implementation

Why should the organization define criteria for accepting privacy risk before conducting the risk assessment?

  1. To avoid documenting the assessment
  2. To eliminate the need for management review
  3. To guarantee that no risk ever materializes
  4. To ensure consistent decisions about which risks require treatment Correct answer.

Explanation

Risk acceptance criteria give a consistent benchmark for deciding whether a risk is tolerable or requires treatment. Defining them in advance prevents ad hoc decisions and supports comparability across assessments. They do not guarantee that risks will not occur.

Question 47Initiation of the PIMS implementation

An organization discovers that a legacy system stores PII without a documented purpose. What is the most appropriate initiation-phase action?

  1. Ignore it because the system is legacy
  2. Transfer the data to a third party to avoid responsibility
  3. Document the processing purpose or remediate the processing, and add it to the PII register and risk assessment Correct answer.
  4. Delete the entire system immediately without analysis

Explanation

Undocumented processing represents a gap in accountability and must be brought into the PIMS. The organization should determine and document a lawful purpose or stop the processing, then assess the associated risks. Immediate deletion without analysis may destroy records needed for other obligations.

Question 48Initiation of the PIMS implementation

When scoping the PIMS, how should shared services such as HR and IT that support multiple business units be handled?

  1. Exclude them because they serve several units
  2. Include them where they process PII within the defined scope, documenting interfaces and responsibilities Correct answer.
  3. Include them only if they are outsourced
  4. Assign them to the marketing department

Explanation

Shared services often process PII for many parts of the organization, so their inclusion depends on whether they fall within the defined scope. Interfaces and responsibilities should be documented to avoid gaps at boundaries. Excluding them purely because they are shared would leave processing uncovered.

Question 49Initiation of the PIMS implementation

An organization operates in several jurisdictions with differing breach notification deadlines. How should this affect PIMS initiation?

  1. Identify each applicable obligation and design notification procedures that satisfy the strictest relevant requirement Correct answer.
  2. Ignore notification duties until an incident occurs
  3. Adopt the longest deadline across all jurisdictions for simplicity
  4. Apply only the rules of the headquarters country

Explanation

Differing obligations must be identified and reflected in procedures so that each jurisdiction's requirements can be met. Designing to the strictest relevant requirement is a common way to avoid breaches of shorter deadlines. Ignoring or simplifying away obligations creates compliance risk.

Question 50Initiation of the PIMS implementation

A team argues that because the ISMS already has an asset inventory, no separate PII inventory is needed. What is the strongest response under ISO/IEC 27701?

  1. The asset inventory is sufficient because all assets contain PII
  2. A PII-specific view is needed to record processing purposes, categories of PII and PII principals, which a general asset inventory does not capture Correct answer.
  3. PII inventories are only required after certification
  4. The ISMS asset inventory should be deleted

Explanation

A general asset inventory records systems and hardware but typically lacks the processing context required for privacy management. A PII processing register captures purposes, data categories, principals, recipients and retention. The two views complement each other rather than replace one another.