90 free IAPP CIPM practice questions from the CertStash pack of 361, each with the correct answer and a full explanation. The rule is the same for every exam: ten free on the product page, 90 free here, all 361 in the pack, and each step includes the one before it.
Get all 361 questions (US$39) · Download the first 10 as a PDF
Question 1
SCENARIO Please use the following to answer the next question: Richard McAdams recently graduated law school and decided to return to the small town of Lexington, Virginia to help run his aging grandfather's law practice. The elder McAdams desired a limited, lighter role in the practice, with the hope that his grandson would eventually take over when he fully retires. In addition to hiring Richard, Mr. McAdams employs two paralegals, an administrative assistant, and a part-time IT specialist who handles all of their basic networking needs. He plans to hire more employees once Richard gets settled and assesses the office's strategies for growth. Immediately upon arrival, Richard was amazed at the amount of work that needed to done in order to modernize the office, mostly in regard to the handling of clients' personal data. His first goal is to digitize all the records kept in file cabinets, as many of the documents contain personally identifiable financial and medical data. Also, Richard has noticed the massive amount of copying by the administrative assistant throughout the day, a practice that not only adds daily to the number of files in the file cabinets, but may create security issues unless a formal policy is firmly in place Richard is also concerned with the overuse of the communal copier/printer located in plain view of clients who frequent the building. Yet another area of concern is the use of the same fax machine by all of the employees. Richard hopes to reduce its use dramatically in order to ensure that personal data receives the utmost security and protection, and eventually move toward a strict Internet faxing policy by the year's end. Richard expressed his concerns to his grandfather, who agreed, that updating data storage, data security, and an overall approach to increasing the protection of personal data in all facets is necessary Mr. McAdams granted him the freedom and authority to do so. Now Richard is not only beginning a career as an attorney, but also functioning as the privacy officer of the small firm. Richard plans to meet with the IT employee the following day, to get insight into how the office computer system is currently set-up and managed. Richard believes that a transition from the use of fax machine to Internet faxing provides all of the following security benefits EXCEPT?
Show answer and explanation
Correct answer: A. Greater accessibility to the faxes at an off-site location.
Internet faxing provides security benefits including encryption through secure servers, reduced risk of unauthorized viewing, and electronic storage with password protection. However, greater accessibility to faxes at off-site locations is a business convenience feature, not a security benefit, in fact, increased accessibility to multiple locations can introduce additional security risks by expanding the number of potential access points to sensitive data.
Why the other options are wrong
- B. Encryption through secure servers is a direct security benefit of Internet faxing.
- C. Reducing risk of data being seen by unauthorized personnel is a core security advantage.
- D. Electronic storage with password protection is a key security benefit of Internet faxing.
Question 2
SCENARIO Please use the following to answer the next question: Richard McAdams recently graduated law school and decided to return to the small town of Lexington, Virginia to help run his aging grandfather's law practice. The elder McAdams desired a limited, lighter role in the practice, with the hope that his grandson would eventually take over when he fully retires. In addition to hiring Richard, Mr. McAdams employs two paralegals, an administrative assistant, and a part-time IT specialist who handles all of their basic networking needs. He plans to hire more employees once Richard gets settled and assesses the office's strategies for growth. Immediately upon arrival, Richard was amazed at the amount of work that needed to done in order to modernize the office, mostly in regard to the handling of clients' personal data. His first goal is to digitize all the records kept in file cabinets, as many of the documents contain personally identifiable financial and medical data. Also, Richard has noticed the massive amount of copying by the administrative assistant throughout the day, a practice that not only adds daily to the number of files in the file cabinets, but may create security issues unless a formal policy is firmly in place Richard is also concerned with the overuse of the communal copier/printer located in plain view of clients who frequent the building. Yet another area of concern is the use of the same fax machine by all of the employees. Richard hopes to reduce its use dramatically in order to ensure that personal data receives the utmost security and protection, and eventually move toward a strict Internet faxing policy by the year's end. Richard expressed his concerns to his grandfather, who agreed, that updating data storage, data security, and an overall approach to increasing the protection of personal data in all facets is necessary Mr. McAdams granted him the freedom and authority to do so. Now Richard is not only beginning a career as an attorney, but also functioning as the privacy officer of the small firm. Richard plans to meet with the IT employee the following day, to get insight into how the office computer system is currently set-up and managed. As Richard begins to research more about Data Lifecycle Management (DLM), he discovers that the law office can lower the risk of a data breach by doing what?
Show answer and explanation
Correct answer: C. Reducing the volume and the type of data that is stored in its system.
Data Lifecycle Management principles emphasize minimizing risk by reducing the volume and types of data stored within a system. The less sensitive data an organization maintains, the smaller the potential impact of a data breach. By limiting data collection to only what is necessary and eliminating unnecessary data types, the firm significantly reduces exposure and breach risk.
Why the other options are wrong
- A. Prioritizing data by importance does not reduce the volume of data at risk or lower breach likelihood.
- B. Minimizing retrieval time does not address the fundamental risk of data breach or reduce the amount of vulnerable data.
- D. Increasing staff to code and categorize data does not reduce the volume of data stored or the likelihood of breach.
Question 3
SCENARIO Please use the following to answer the next question: Richard McAdams recently graduated law school and decided to return to the small town of Lexington, Virginia to help run his aging grandfather's law practice. The elder McAdams desired a limited, lighter role in the practice, with the hope that his grandson would eventually take over when he fully retires. In addition to hiring Richard, Mr. McAdams employs two paralegals, an administrative assistant, and a part-time IT specialist who handles all of their basic networking needs. He plans to hire more employees once Richard gets settled and assesses the office's strategies for growth. Immediately upon arrival, Richard was amazed at the amount of work that needed to done in order to modernize the office, mostly in regard to the handling of clients' personal data. His first goal is to digitize all the records kept in file cabinets, as many of the documents contain personally identifiable financial and medical data. Also, Richard has noticed the massive amount of copying by the administrative assistant throughout the day, a practice that not only adds daily to the number of files in the file cabinets, but may create security issues unless a formal policy is firmly in place Richard is also concerned with the overuse of the communal copier/printer located in plain view of clients who frequent the building. Yet another area of concern is the use of the same fax machine by all of the employees. Richard hopes to reduce its use dramatically in order to ensure that personal data receives the utmost security and protection, and eventually move toward a strict Internet faxing policy by the year's end. Richard expressed his concerns to his grandfather, who agreed, that updating data storage, data security, and an overall approach to increasing the protection of personal data in all facets is necessary Mr. McAdams granted him the freedom and authority to do so. Now Richard is not only beginning a career as an attorney, but also functioning as the privacy officer of the small firm. Richard plans to meet with the IT employee the following day, to get insight into how the office computer system is currently set-up and managed. Which of the following policy statements needs additional instructions in order to further protect the personal data of their clients?
Show answer and explanation
Correct answer: B. All unused copies, prints, and faxes must be discarded in a designated recycling bin located near the work station and emptied daily.
Option B lacks critical implementation details necessary to actually protect personal data. While it specifies that unused documents must be discarded in a recycling bin emptied daily, it does not address how documents should be destroyed, whether they should be shredded, incinerated, or otherwise rendered unrecoverable. Without specific destruction methods, the policy fails to adequately protect sensitive data that could still be retrieved from recycled materials. The other options provide complete, actionable protections.
Why the other options are wrong
- A. This policy provides comprehensive protection by documenting faxes and verifying recipient numbers.
- C. This policy adequately protects data by requiring hard drive deletion before device disposal.
- D. This policy provides complete protection by controlling visibility during printing and ensuring immediate document retrieval.
Question 4
SCENARIO Please use the following to answer the next question: Richard McAdams recently graduated law school and decided to return to the small town of Lexington, Virginia to help run his aging grandfather's law practice. The elder McAdams desired a limited, lighter role in the practice, with the hope that his grandson would eventually take over when he fully retires. In addition to hiring Richard, Mr. McAdams employs two paralegals, an administrative assistant, and a part-time IT specialist who handles all of their basic networking needs. He plans to hire more employees once Richard gets settled and assesses the office's strategies for growth. Immediately upon arrival, Richard was amazed at the amount of work that needed to done in order to modernize the office, mostly in regard to the handling of clients' personal data. His first goal is to digitize all the records kept in file cabinets, as many of the documents contain personally identifiable financial and medical data. Also, Richard has noticed the massive amount of copying by the administrative assistant throughout the day, a practice that not only adds daily to the number of files in the file cabinets, but may create security issues unless a formal policy is firmly in place Richard is also concerned with the overuse of the communal copier/printer located in plain view of clients who frequent the building. Yet another area of concern is the use of the same fax machine by all of the employees. Richard hopes to reduce its use dramatically in order to ensure that personal data receives the utmost security and protection, and eventually move toward a strict Internet faxing policy by the year's end. Richard expressed his concerns to his grandfather, who agreed, that updating data storage, data security, and an overall approach to increasing the protection of personal data in all facets is necessary Mr. McAdams granted him the freedom and authority to do so. Now Richard is not only beginning a career as an attorney, but also functioning as the privacy officer of the small firm. Richard plans to meet with the IT employee the following day, to get insight into how the office computer system is currently set-up and managed. Richard needs to closely monitor the vendor in charge of creating the firm's database mainly because of what?
Show answer and explanation
Correct answer: B. The vendor may not be aware of the privacy implications involved in the project.
Richard must closely monitor the database vendor primarily because vendors may not be aware of the privacy implications and requirements involved in the project. A vendor focused on technical database creation may lack understanding of legal, regulatory, and organizational privacy obligations. While vendors do handle data and may have security vulnerabilities, the core reason for close monitoring is ensuring they understand and implement privacy requirements that may not be their primary expertise.
Why the other options are wrong
- A. Vendors are not typically required to report violations to authorities; the organization itself bears this responsibility.
- C. While vendors should be questioned about vulnerabilities, lack of forthcoming information is a symptom rather than the primary reason for monitoring.
- D. Direct contact with data is important to consider, but the primary monitoring concern is whether the vendor understands privacy implications.
Question 5
What should be the first major goal of a company developing a new privacy program?
Show answer and explanation
Correct answer: B. To schedule conversations with executives of affected departments.
The first major goal when developing a new privacy program should be to schedule conversations with executives of affected departments. These foundational discussions establish stakeholder engagement, identify organizational needs, understand departmental data flows, and secure executive buy-in and support. This critical step must precede resource allocation, third-party processor identification, or policy creation, as leadership alignment and departmental understanding form the basis for all subsequent privacy initiatives.
Why the other options are wrong
- A. Surveying funding sources is premature before understanding organizational needs and requirements.
- C. Identifying third-party processors requires first understanding what data exists and how it is used.
- D. Creating DLM policies is premature without first understanding the organization's structure and executive commitment.
Question 6
Which is TRUE about the scope and authority of data protection oversight authorities?
Show answer and explanation
Correct answer: C. No one agency officially oversees the enforcement of privacy regulations in the United States.
The United States does not have a single official agency that oversees enforcement of privacy regulations. Instead, privacy oversight is fragmented across multiple federal agencies including the FTC, HHS, state attorneys general, and various industry-specific regulators. This decentralized approach contrasts with countries like Canada (which has the OPC with enforcement powers) and the European Union (which has coordinated data protection authorities).
Why the other options are wrong
- A. The Office of the Privacy Commissioner of Canada can impose financial sanctions, making this true but not the best answer about U.S. authority.
- B. While the DPC plays a significant role in the EU, authority is distributed among member state authorities and the European Data Protection Board.
- D. APEC Privacy Framework is voluntary and non-binding; members are not required to designate a national data protection authority.
Question 7
What should a privacy professional keep in mind when selecting which metrics to collect?
Show answer and explanation
Correct answer: B. The number of metrics should be limited at first.
When selecting metrics to collect, a privacy professional should limit the number of metrics at first. Starting with a focused set of meaningful metrics allows for effective measurement, analysis, and management before expanding. Attempting to collect too many metrics simultaneously can become unwieldy, dilute focus, and fail to provide actionable insights. A limited, well-chosen initial set of metrics provides a foundation for understanding what works before scaling up.
Why the other options are wrong
- A. Metrics may be reported to stakeholders, but public reporting is not a primary consideration when selecting them.
- C. Privacy metrics should measure privacy compliance and risk, not strategies for increasing company earnings.
- D. Metrics should be selected based on specific intended functions and organizational goals before collection begins.
Question 8
Which statement is FALSE regarding the use of technical security controls?
Show answer and explanation
Correct answer: C. Most privacy legislation lists the types of technical security controls that must be implemented.
Most privacy legislation does not list specific types of technical security controls that must be implemented. Instead, legislation typically requires organizations to implement 'appropriate' or 'reasonable' technical controls without prescribing exact technologies, allowing flexibility based on organizational context and risk assessment. Options A, B, and D are all accurate statements: technical controls are part of data governance, controls designed for one jurisdiction often satisfy others due to overlapping requirements, and security expertise is essential during deployment.
Why the other options are wrong
- A. Technical security controls are indeed a key component of comprehensive data governance strategies.
- B. Controls meeting stringent requirements often satisfy less stringent jurisdictions, making cross-jurisdictional compliance practical.
- D. Personnel with security knowledge should definitely be involved in deploying technical controls to ensure proper implementation.
Question 9
An organization's privacy officer was just notified by the benefits manager that she accidentally sent out the retirement enrollment report of all employees to a wrong vendor. Which of the following actions should the privacy officer take first?
Show answer and explanation
Correct answer: C. Contact the recipient to delete the email.
The immediate first action should be to contact the recipient to request deletion of the email and prevent further dissemination of the sensitive data. This containment step minimizes the scope of the breach before other response activities. Risk analysis follows after containment is attempted, law enforcement involvement comes after initial assessment, and firm-wide notification should only occur after understanding the breach scope and legal requirements.
Why the other options are wrong
- A. Risk analysis is important but should follow the immediate containment effort.
- B. Law enforcement reporting may be required depending on jurisdiction and circumstances, but containment comes first.
- D. Employee notification should occur only after assessing legal obligations and breach scope.
Question 10
Why were the nongovernmental privacy organizations, Electronic Frontier Foundation (EFF) and Electronic Privacy Information Center (EPIC), established?
Show answer and explanation
Correct answer: C. To protect civil liberties and raise consumer awareness.
The Electronic Frontier Foundation (EFF) and Electronic Privacy Information Center (EPIC) were established to protect civil liberties and raise consumer awareness about privacy issues. Both organizations focus on advocating for individual privacy rights, monitoring threats to digital privacy and freedom, educating the public about privacy concerns, and challenging government and corporate surveillance practices. Their missions center on civil liberties protection and public education rather than industry promotion, shopping experience, or technical encryption standards.
Why the other options are wrong
- A. While these organizations may indirectly support consumer confidence, their primary purpose is advocacy and education, not promoting industry confidence.
- B. Improving online shopping experience is not a stated mission of these privacy-focused advocacy organizations.
- D. While encryption is relevant to privacy, these organizations' establishment focused on broader civil liberties and privacy protection rather than promoting specific technical solutions.
What people say about the full CIPM pack 5.0 from 1
Passed CIPM with the Cert Stash file in Germany. I can confirm that is accurate.
Question 11
SCENARIO Please use the following to answer the next question: Perhaps Jack Kelly should have stayed in the U.S. He enjoys a formidable reputation inside the company, Special Handling Shipping, for his work in reforming certain "rogue" offices. Last year, news broke that a police sting operation had revealed a drug ring operating in the Providence, Rhode Island office in the United States. Video from the office's video surveillance cameras leaked to news operations showed a drug exchange between Special Handling staff and undercover officers. In the wake of this incident, Kelly had been sent to Providence to change the "hands off" culture that upper management believed had let the criminal elements conduct their illicit transactions. After a few weeks under Kelly's direction, the office became a model of efficiency and customer service. Kelly monitored his workers' activities using the same cameras that had recorded the illegal conduct of their former co-workers. Now Kelly has been charged with turning around the office in Cork, Ireland, another trouble spot. The company has received numerous reports of the staff leaving the office unattended. When Kelly arrived, he found that even when present, the staff often spent their days socializing or conducting personal business on their mobile phones. Again, he observed their behaviors using surveillance cameras. He issued written reprimands to six staff members based on the first day of video alone. Much to Kelly's surprise and chagrin, he and the company are now under investigation by the Data Protection Commissioner of Ireland for allegedly violating the privacy rights of employees. Kelly was told that the company's license for the cameras listed facility security as their main use, but he does not know why this matters. He has pointed out to his superiors that the company's training programs on privacy protection and data collection mention nothing about surveillance video. You are a privacy protection consultant, hired by the company to assess this incident, report on the legal and compliance issues, and recommend next steps. Knowing that the regulator is now investigating, what would be the best step to take?
Show answer and explanation
Correct answer: A. Consult an attorney experienced in privacy law and litigation.
When an organization is under investigation by a regulatory authority for potential legal violations, the appropriate immediate step is to consult with legal counsel experienced in privacy law and litigation. An attorney can provide proper guidance on responding to regulatory inquiries, protecting the organization's interests, and navigating the investigation process. Option B is inappropriate because privacy consultants should not attempt to substitute for legal representation. Option C presupposes guilt without investigation. Option D involves negotiating before understanding the regulator's position and without proper legal counsel, risking unfavorable outcomes.
Why the other options are wrong
- B. A privacy consultant's background does not substitute for specialized legal counsel when regulatory investigations and potential litigation are involved.
- C. Admitting guilt prematurely without legal review exposes the organization to unnecessary liability and penalties.
- D. Negotiating a settlement before consulting legal counsel and understanding the investigation's scope is premature and risks unfavorable terms.
Question 12
SCENARIO Please use the following to answer the next question: As the Director of data protection for Consolidated Records Corporation, you are justifiably pleased with your accomplishments so far. Your hiring was precipitated by warnings from regulatory agencies following a series of relatively minor data breaches that could easily have been worse. However, you have not had a reportable incident for the three years that you have been with the company. In fact, you consider your program a model that others in the data storage industry may note in their own program development. You started the program at Consolidated from a jumbled mix of policies and procedures and worked toward coherence across departments and throughout operations. You were aided along the way by the program's sponsor, the vice president of operations, as well as by a Privacy Team that started from a clear understanding of the need for change. Initially, your work was greeted with little confidence or enthusiasm by the company's "old guard" among both the executive team and frontline personnel working with data and interfacing with clients. Through the use of metrics that showed the costs not only of the breaches that had occurred, but also projections of the costs that easily could occur given the current state of operations, you soon had the leaders and key decision-makers largely on your side. Many of the other employees were more resistant, but face-to-face meetings with each department and the development of a baseline privacy training program achieved sufficient "buy-in" to begin putting the proper procedures into place. Now, privacy protection is an accepted component of all current operations involving personal or protected data and must be part of the end product of any process of technological development. While your approach is not systematic, it is fairly effective. You are left contemplating: What must be done to maintain the program and develop it beyond just a data breach prevention program? How can you build on your success? What are the next action steps? What analytic can be used to track the financial viability of the program as it develops?
Show answer and explanation
Correct answer: C. Return to investment.
Return on Investment (ROI) directly measures the financial viability of the privacy program by comparing the value gained from the program against its costs. ROI demonstrates whether investments in privacy protection are yielding measurable financial benefits through breach prevention, regulatory compliance, and reduced operational risks.
Why the other options are wrong
- A. Cost basis tracks initial investment costs but does not measure the viability or financial performance of the program over time.
- B. Gap analysis identifies differences between current and desired states but does not provide financial viability tracking or return metrics.
- D. Breach impact modeling projects potential costs of breaches but is a planning tool rather than a metric for tracking the actual financial performance of an active program.
Question 13
Which of the following controls does the PCI DSS framework NOT require?
Show answer and explanation
Correct answer: A. Implement strong asset control protocols.
PCI DSS (Payment Card Industry Data Security Standard) does not specifically require strong asset control protocols as a primary framework component. While PCI DSS addresses access control, security policies, and vulnerability management, asset control protocols are not explicitly mandated as a core requirement of the standard.
Why the other options are wrong
- B. PCI DSS explicitly requires strong access control measures to protect cardholder data.
- C. PCI DSS explicitly requires maintaining an information security policy as a foundational requirement.
- D. PCI DSS explicitly requires maintaining a vulnerability management program to identify and remediate security weaknesses.
Question 14
SCENARIO Please use the following to answer the next question: Manasa is a product manager at Omnipresent Omnimedia, where she is responsible for leading the development of the company's flagship product, the Handy Helper. The Handy Helper is an application that can be used in the home to manage family calendars, do online shopping, and schedule doctor appointments. After having had a successful launch in the United States, the Handy Helper is about to be made available for purchase worldwide. The packaging and user guide for the Handy Helper indicate that it is a "privacy friendly" product suitable for the whole family, including children, but does not provide any further detail or privacy notice. In order to use the application, a family creates a single account, and the primary user has access to all information about the other users. Upon start up, the primary user must check a box consenting to receive marketing emails from Omnipresent Omnimedia and selected marketing partners in order to be able to use the application. Sanjay, the head of privacy at Omnipresent Omnimedia, was working on an agreement with a European distributor of Handy Helper when he fielded many questions about the product from the distributor. Sanjay needed to look more closely at the product in order to be able to answer the questions as he was not involved in the product development process. In speaking with the product team, he learned that the Handy Helper collected and stored all of a user's sensitive medical information for the medical appointment scheduler. In fact, all of the user's information is stored by Handy Helper for the additional purpose of creating additional products and to analyze usage of the product. This data is all stored in the cloud and is encrypted both during transmission and at rest. Consistent with the CEO's philosophy that great new product ideas can come from anyone, all Omnipresent Omnimedia employees have access to user data under a program called Eureka. Omnipresent Omnimedia is hoping that at some point in the future, the data will reveal insights that could be used to create a fully automated application that runs on artificial intelligence, but as of yet, Eureka is not well-defined and is considered a long-term goal. What element of the Privacy by Design (PbD) framework might the Handy Helper violate?
Show answer and explanation
Correct answer: D. Failure to integrate privacy throughout the system development life cycle.
The Privacy by Design framework requires integrating privacy considerations throughout the entire system development life cycle, from initial conception through deployment and beyond. The Handy Helper was developed without privacy involvement from the start, Sanjay, the privacy officer, only learned about the product's data practices after development was complete. This represents a fundamental failure to embed privacy throughout the development process. While marketing consent issues exist, they reflect implementation problems rather than a framework violation. Data localization is a regulatory requirement, not a PbD framework element. The least privilege access issue is a safeguard implementation gap but not the core PbD framework violation demonstrated here.
Why the other options are wrong
- A. Consent issues are important compliance matters but do not specifically violate the Privacy by Design framework principle of integration throughout development.
- B. Data localization is a regulatory compliance requirement, not an element of the Privacy by Design framework.
- C. While the lack of least privilege access is a serious safeguard failure, it is not the framework violation most central to this scenario.
Question 15
Which is the best way to view an organization’s privacy framework?
Show answer and explanation
Correct answer: D. As a living structure that aligns to changes in the organization
A privacy framework should be viewed as a living structure that continuously evolves and aligns with organizational changes, regulatory updates, and emerging privacy risks. This dynamic perspective enables organizations to maintain relevance and effectiveness. Treating it as a benchmark applies external standards without customization, viewing it as fixed prevents necessary adaptation, and aspirational goals without structural alignment lack practical implementation.
Why the other options are wrong
- A. Industry benchmarks are external references, not the organization's own framework structure.
- B. A fixed structure cannot accommodate necessary organizational and regulatory changes.
- C. Aspirational goals alone lack the structural grounding needed for implementation and accountability.
Question 16
If an organization maintains a separate ethics office, to whom would its officer typically report to in order to retain the greatest degree of independence?
Show answer and explanation
Correct answer: A. The Board of Directors.
An ethics office must maintain independence from operational management to investigate and report on potential misconduct without pressure or conflicts of interest. Reporting to the Board of Directors provides the highest level of organizational independence, as the board is responsible for governance oversight and exists outside daily operational structures. This reporting relationship ensures that ethics concerns, including potential board-level misconduct, can be raised and investigated without fear of retaliation from executive management.
Why the other options are wrong
- B. The CFO has financial interests that could conflict with ethics investigations involving fiscal matters.
- C. The HR Director may be involved in personnel matters under investigation, creating a conflict of interest.
- D. The General Counsel represents the organization's legal interests, which may conflict with independent ethics investigations.
Question 17
SCENARIO Please use the following to answer the next question: As the Director of data protection for Consolidated Records Corporation, you are justifiably pleased with your accomplishments so far. Your hiring was precipitated by warnings from regulatory agencies following a series of relatively minor data breaches that could easily have been worse. However, you have not had a reportable incident for the three years that you have been with the company. In fact, you consider your program a model that others in the data storage industry may note in their own program development. You started the program at Consolidated from a jumbled mix of policies and procedures and worked toward coherence across departments and throughout operations. You were aided along the way by the program's sponsor, the vice president of operations, as well as by a Privacy Team that started from a clear understanding of the need for change. Initially, your work was greeted with little confidence or enthusiasm by the company's "old guard" among both the executive team and frontline personnel working with data and interfacing with clients. Through the use of metrics that showed the costs not only of the breaches that had occurred, but also projections of the costs that easily could occur given the current state of operations, you soon had the leaders and key decision-makers largely on your side. Many of the other employees were more resistant, but face-to-face meetings with each department and the development of a baseline privacy training program achieved sufficient "buy-in" to begin putting the proper procedures into place. Now, privacy protection is an accepted component of all current operations involving personal or protected data and must be part of the end product of any process of technological development. While your approach is not systematic, it is fairly effective. You are left contemplating: What must be done to maintain the program and develop it beyond just a data breach prevention program? How can you build on your success? What are the next action steps? What process could most effectively be used to add privacy protections to a new, comprehensive program being developed at the company?
Show answer and explanation
Correct answer: A. Privacy by Design (PbD).
Privacy by Design (PbD) is the established methodology for integrating privacy protections into new systems and programs from their inception. It ensures privacy considerations are built into the development process itself, addressing privacy requirements throughout the design and implementation phases rather than as an afterthought.
Why the other options are wrong
- B. Privacy Step Assessment is not a recognized standard framework for integrating privacy into new program development.
- C. Information Security Planning is broader than privacy and does not specifically address the systematic integration of privacy into new initiatives.
- D. Innovation Privacy Standards is not an established process for adding privacy protections to comprehensive programs being developed.
Question 18
In which situation would a Privacy Impact Assessment (PIA) be the least likely to be required?
Show answer and explanation
Correct answer: A. If a company created a credit-scoring platform five years ago.
A Privacy Impact Assessment is required when organizations introduce new data processing activities that pose privacy risks. A company that created a credit-scoring platform five years ago is engaging in established processing with a long operational history, making a PIA least likely to be mandated at this point. In contrast, option B involves processing sensitive healthcare/legal data requiring strict confidentiality, option C involves new product development with expanded data usage creating novel privacy risks, and option D involves processing children's sensitive health-related data requiring heightened protection, all scenarios triggering PIA requirements.
Why the other options are wrong
- B. Healthcare and legal professionals processing patient/client data are subject to strict confidentiality obligations that necessitate PIAs.
- C. A social media company creating a new product that compiles personal data for user profiling introduces new processing activities that pose significant privacy risks requiring assessment.
- D. Processing children's data to identify health conditions like food allergies involves sensitive personal information about minors, triggering mandatory PIA requirements.
Question 19
In addition to regulatory requirements and business practices, what important factors must a global privacy strategy consider?
Show answer and explanation
Correct answer: D. Cultural norms.
A global privacy strategy must account for cultural norms because privacy expectations, data handling preferences, and information sensitivity vary significantly across cultures. Different regions have distinct cultural values regarding individual privacy, family data sharing, and the relationship between individuals and organizations. These cultural differences directly impact how privacy programs must be designed and implemented. Monetary exchange rates are financial considerations unrelated to privacy strategy design. Geographic features affect data infrastructure but not privacy philosophy or strategy. Political history, while contextual, is less directly applicable than current cultural norms to privacy program requirements.
Why the other options are wrong
- A. Currency exchange rates are financial matters unrelated to the substantive design of privacy strategies.
- B. Geographic features relate to infrastructure and data center placement but not to privacy strategy fundamentals.
- C. While history provides context, current cultural norms are the more direct and important factor for privacy strategy development.
Question 20
What is one obligation that the General Data Protection Regulation (GDPR) imposes on data processors?
Show answer and explanation
Correct answer: C. To implement appropriate technical and organizational measures that ensure an appropriate level of security.
Under the GDPR, data processors are obligated to implement appropriate technical and organizational measures that ensure an appropriate level of security. This is a core processor responsibility found in Article 32 of the GDPR. Processors must ensure security of personal data through measures such as encryption, access controls, and security protocols proportionate to the risk of processing.
Why the other options are wrong
- A. Honoring data access requests is a controller obligation, not a processor obligation under GDPR.
- B. Informing data subjects about controller identity and contact details is a transparency obligation of the controller, not the processor.
- D. Conducting data protection impact assessments is primarily a controller responsibility, though processors may assist in high-risk scenarios.
Question 21
What is a key feature of the privacy metric template adapted from the National Institute of Standards and Technology (NIST)?
Show answer and explanation
Correct answer: B. It can be tailored to an organization's particular needs.
The NIST privacy metric templates are designed as flexible frameworks that organizations can adapt to their specific contexts, risk profiles, regulatory environments, and operational requirements. This adaptability is a core feature that allows diverse organizations across different sectors and sizes to apply a consistent methodological approach while maintaining relevance to their particular circumstances and privacy objectives.
Why the other options are wrong
- A. While NIST provides guidance on measurement approaches, the templates themselves are not primarily focused on data collection methods.
- C. NIST standards are updated periodically based on technological and threat changes, not on an automatic annual cycle tied to government policy shifts.
- D. NIST privacy frameworks are applicable to all types of organizations regardless of international business scope.
Question 22
SCENARIO Please use the following to answer the next question: Manasa is a product manager at Omnipresent Omnimedia, where she is responsible for leading the development of the company's flagship product, the Handy Helper. The Handy Helper is an application that can be used in the home to manage family calendars, do online shopping, and schedule doctor appointments. After having had a successful launch in the United States, the Handy Helper is about to be made available for purchase worldwide. The packaging and user guide for the Handy Helper indicate that it is a "privacy friendly" product suitable for the whole family, including children, but does not provide any further detail or privacy notice. In order to use the application, a family creates a single account, and the primary user has access to all information about the other users. Upon start up, the primary user must check a box consenting to receive marketing emails from Omnipresent Omnimedia and selected marketing partners in order to be able to use the application. Sanjay, the head of privacy at Omnipresent Omnimedia, was working on an agreement with a European distributor of Handy Helper when he fielded many questions about the product from the distributor. Sanjay needed to look more closely at the product in order to be able to answer the questions as he was not involved in the product development process. In speaking with the product team, he learned that the Handy Helper collected and stored all of a user's sensitive medical information for the medical appointment scheduler. In fact, all of the user's information is stored by Handy Helper for the additional purpose of creating additional products and to analyze usage of the product. This data is all stored in the cloud and is encrypted both during transmission and at rest. Consistent with the CEO's philosophy that great new product ideas can come from anyone, all Omnipresent Omnimedia employees have access to user data under a program called Eureka. Omnipresent Omnimedia is hoping that at some point in the future, the data will reveal insights that could be used to create a fully automated application that runs on artificial intelligence, but as of yet, Eureka is not well-defined and is considered a long-term goal. What administrative safeguards should be implemented to protect the collected data while in use by Manasa and her product management team?
Show answer and explanation
Correct answer: C. Implement a policy restricting data access on a "need to know" basis.
Implementing a "need to know" basis policy restricts data access to only those employees who require it to perform their specific job functions. This is the least privilege principle applied as an administrative safeguard. The Eureka program currently grants all employees broad access to sensitive user data, which violates this principle. Restricting access through role-based policies protects data while it is actively used by teams like product management. Documenting data flows provides visibility but does not restrict access. Conducting a Privacy Impact Assessment identifies risks but does not implement safeguards. Data localization addresses geographic requirements but not access controls for current users.
Why the other options are wrong
- A. Documenting data flows creates transparency but does not actively control or restrict who can access sensitive data.
- B. A Privacy Impact Assessment identifies and evaluates risks but does not implement the administrative safeguards needed to protect data in use.
- D. Data localization requirements address geographic data storage but do not address access controls for employees currently using the data.
Question 23
When implementing Privacy by Design (PbD), what would NOT be a key consideration?
Show answer and explanation
Correct answer: C. Limitations on liability.
Limitations on liability is not a key consideration in Privacy by Design implementation. PbD focuses on embedding privacy protections into systems and processes through principles such as collection limitation (restricting what data is collected), data minimization (collecting only necessary data), and purpose specification (defining why data is collected). Liability limitations are legal/contractual matters that come after system design, not core PbD design considerations.
Why the other options are wrong
- A. Collection limitation is a foundational PbD principle restricting data collection scope.
- B. Data minimization is a core PbD principle ensuring only necessary data is processed.
- D. Purpose specification is a key PbD principle defining legitimate uses for collected data.
Question 24
There are different forms of monitoring available for organizations to consider when aligning with their privacy program goals. Which of the following forms of monitoring is best described as ‘auditing’?
Show answer and explanation
Correct answer: A. Evaluating operations, systems, and processes.
Auditing in the context of privacy programs is defined as the systematic evaluation of operations, systems, and processes to assess compliance with privacy requirements and standards. It involves examining how the organization handles data, implements controls, and adheres to policies. Tracking complaints is monitoring, assisting with attestation reporting is compliance documentation, and overseeing third-party requirements is vendor management, none of these define auditing itself.
Why the other options are wrong
- B. Tracking and documenting complaints is a monitoring function, not auditing.
- C. Assisting with attestation reporting is compliance documentation, not auditing.
- D. Overseeing third-party security and privacy requirements is vendor management, not auditing.
Question 25
All of the following changes will likely trigger a data inventory update EXCEPT?
Show answer and explanation
Correct answer: D. Passage of a new privacy regulation.
The passage of a new privacy regulation will likely not trigger a data inventory update. While new regulations may require changes to how data is handled, managed, or protected, the passage of regulation itself doesn't change what data the organization actually holds or where it flows. In contrast, outsourcing functions, acquiring subsidiaries, and onboarding vendors all directly change the organization's data processing landscape and require inventory updates.
Why the other options are wrong
- A. Outsourcing a function like CRM changes where and how customer data is processed, requiring inventory updates.
- B. Acquiring a subsidiary introduces new data systems and data flows that must be added to the inventory.
- C. Onboarding a new vendor creates new data processing relationships that must be documented in the data inventory.
Question 26
SCENARIO Please use the following to answer the next question: As they company’s new chief executive officer, Thomas Goddard wants to be known as a leader in data protection. Goddard recently served as the chief financial officer of Hoopy.com, a pioneer in online video viewing with millions of users around the world. Unfortunately, Hoopy is infamous within privacy protection circles for its ethically questionable practices, including unauthorized sales of personal data to marketers. Hoopy also was the target of credit card data theft that made headlines around the world, as at least two million credit card numbers were thought to have been pilfered despite the company’s claims that “appropriate” data protection safeguards were in place. The scandal affected the company’s business as competitors were quick to market an increased level of protection while offering similar entertainment and media content. Within three weeks after the scandal broke, Hoopy founder and CEO Maxwell Martin, Goddard’s mentor, was forced to step down. Goddard, however, seems to have landed on his feet, securing the CEO position at your company, Medialite, which is just emerging from its startup phase. He sold the company’s board and investors on his vision of Medialite building its brand partly on the basis of industry-leading data protection standards and procedures. He may have been a key part of a lapsed or even rogue organization in matters of privacy but now he claims to be reformed and a true believer in privacy protection. In his first week on the job, he calls you into his office and explains that your primary work responsibility is to bring his vision for privacy to life. But you also detect some reservations. “We want Medialite to have absolutely the highest standards,” he says. “In fact, I want us to be able to say that we are the clear industry leader in privacy and data protection. However, I also need to be a responsible steward of the company’s finances. So, while I want the best solutions across the board, they also need to be cost effective.” You are told to report back in a week’s time with your recommendations. Charged with this ambiguous mission, you depart the executive suite, already considering your next steps. What metric can Goddard use to assess whether costs associated with implementing new privacy protections are justified?
Show answer and explanation
Correct answer: C. Return on investment
Return on Investment (ROI) is the appropriate metric to assess whether costs associated with implementing privacy protections are justified. ROI measures the financial returns generated relative to the investment made, allowing Goddard to evaluate whether privacy protection expenditures deliver business value through reduced breach risk, improved reputation, customer retention, or competitive advantage. This directly addresses his stated need to balance "the best solutions" with being "a responsible steward of the company's finances."
Why the other options are wrong
- A. Compliance ratio measures adherence to standards but does not quantify financial justification for privacy investments.
- B. Cost-effective mean is not a recognized financial metric for evaluating investment justification.
- D. Implementation measure tracks execution progress but does not assess whether costs produce sufficient business value.
Question 27
When devising effective employee policies to address a particular issue, which of the following should be included in the first draft?
Show answer and explanation
Correct answer: A. Rationale for the policy.
The rationale for a policy, explaining why the policy exists and what problem it addresses, should be included in the first draft as it provides the foundational context and justification for the policy. This rationale guides all subsequent policy elements and ensures stakeholder understanding of the policy's purpose. While points of contact, roles and responsibilities, and application explanations are all important policy components, they are developed after establishing the core rationale.
Why the other options are wrong
- B. Points of contact are important but are secondary details added after core policy content.
- C. Roles and responsibilities should be defined after establishing policy rationale and requirements.
- D. Application explanations are developed after the fundamental policy reasoning is established.
Question 28
SCENARIO Please use the following to answer the next question: John is the new privacy officer at the prestigious international law firm, A&M LLP. A&M LLP is very proud of its reputation in the practice areas of Trusts & Estates and Merger & Acquisition in both U.S. and Europe. During lunch with a colleague from the Information Technology department, John heard that the Head of IT, Derrick, is about to outsource the firm's email continuity service to their existing email security vendor, MessageSafe. Being successful as an email hygiene vendor, MessageSafe is expanding its business by leasing cloud infrastructure from Cloud Inc. to host email continuity service for A&M LLP. John is very concerned about this initiative. He recalled that MessageSafe was in the news six months ago due to a security breach. Immediately, John did a quick research of MessageSafe's previous breach and learned that the breach was caused by an unintentional mistake by an IT administrator. He scheduled a meeting with Derrick to address his concerns. At the meeting, Derrick emphasized that email is the primary method for the firm's lawyers to communicate with clients, thus it is critical to have the email continuity service to avoid any possible email downtime. Derrick has been using the anti-spam service provided by MessageSafe for five years and is very happy with the quality of service provided by MessageSafe. In addition to the significant discount offered by MessageSafe, Derrick emphasized that he can also speed up the onboarding process since the firm already has a service contract in place with MessageSafe. The existing on-premises email continuity solution is about to reach its end of life very soon and he doesn't have the time or resource to look for another solution. Furthermore, the off-premises email continuity service will only be turned on when the email service at A&M LLP's primary and secondary data centers are both down, and the email messages stored at MessageSafe site for continuity service will be automatically deleted after 30 days. Which of the following is the most effective control to enforce MessageSafe's implementation of appropriate technical countermeasures to protect the personal data received from A&M LLP?
Show answer and explanation
Correct answer: B. MessageSafe must flow-down its data protection contract terms with A&M LLP to Cloud Inc.
The most effective control to enforce appropriate technical countermeasures is to require that MessageSafe flow-down its data protection contract terms with A&M LLP to Cloud Inc. This contractual mechanism ensures that Cloud Inc. is legally bound by the same data protection obligations that A&M LLP imposed on MessageSafe, creating a chain of accountability and contractual enforceability for security requirements. This is the standard GDPR approach for controlling sub-processors.
Why the other options are wrong
- A. Due diligence is important but is a one-time assessment; flowing down contract terms creates ongoing legal obligations.
- C. While MessageSafe must apply security controls, this does not create a specific enforcement mechanism or contractual obligation on Cloud Inc. to A&M LLP.
- D. Breach notification is a reactive measure that occurs after an incident, not a proactive control to enforce implementation of countermeasures.
Question 29
SCENARIO Please use the following to answer the next question: Manasa is a product manager at Omnipresent Omnimedia, where she is responsible for leading the development of the company's flagship product, the Handy Helper. The Handy Helper is an application that can be used in the home to manage family calendars, do online shopping, and schedule doctor appointments. After having had a successful launch in the United States, the Handy Helper is about to be made available for purchase worldwide. The packaging and user guide for the Handy Helper indicate that it is a "privacy friendly" product suitable for the whole family, including children, but does not provide any further detail or privacy notice. In order to use the application, a family creates a single account, and the primary user has access to all information about the other users. Upon start up, the primary user must check a box consenting to receive marketing emails from Omnipresent Omnimedia and selected marketing partners in order to be able to use the application. Sanjay, the head of privacy at Omnipresent Omnimedia, was working on an agreement with a European distributor of Handy Helper when he fielded many questions about the product from the distributor. Sanjay needed to look more closely at the product in order to be able to answer the questions as he was not involved in the product development process. In speaking with the product team, he learned that the Handy Helper collected and stored all of a user's sensitive medical information for the medical appointment scheduler. In fact, all of the user's information is stored by Handy Helper for the additional purpose of creating additional products and to analyze usage of the product. This data is all stored in the cloud and is encrypted both during transmission and at rest. Consistent with the CEO's philosophy that great new product ideas can come from anyone, all Omnipresent Omnimedia employees have access to user data under a program called Eureka. Omnipresent Omnimedia is hoping that at some point in the future, the data will reveal insights that could be used to create a fully automated application that runs on artificial intelligence, but as of yet, Eureka is not well-defined and is considered a long-term goal. What step in the system development process did Manasa skip?
Show answer and explanation
Correct answer: B. Work with Sanjay to review any necessary privacy requirements to be built into the product.
Manasa skipped a critical step in the system development process by failing to involve the privacy function early. She should have worked with Sanjay, the head of privacy, during product development to identify and build in privacy requirements before launch. Privacy integration must occur from the beginning of product development, not after the fact. The scenario shows Sanjay only learning about privacy issues when reviewing the product for European distribution. While express written consent for marketing is important, the scenario indicates consent was obtained (albeit problematically through forced consent). The Privacy Shield Framework is a compliance verification step, not a development process step. Building AI features is a product enhancement decision, not a skipped process step.
Why the other options are wrong
- A. While the consent mechanism described is problematic, the answer focuses on obtaining consent rather than the skipped development process step of privacy review.
- C. Privacy Shield Framework certification is a compliance and legal verification matter, not a step in the system development process itself.
- D. Building AI features is a product feature decision, not a standard step in the development process that was skipped.
Question 30
Which of the following is TRUE about the Data Protection Impact Assessment (DPIA) process as required under the General Data Protection Regulation (GDPR)?
Show answer and explanation
Correct answer: C. The DPIA must include a description of the proposed processing operation and its purpose.
Under GDPR Article 35, a Data Protection Impact Assessment must include a description of the envisaged processing operations and their purposes, along with an assessment of necessity, proportionality, and risks. This is a core, mandatory component of the DPIA process. While DPIAs may be reported to supervisory authorities in certain circumstances, they are not automatically required to be reported, nor are they required to be published publicly as a blanket rule.
Why the other options are wrong
- A. DPIA results must be reported to supervisory authorities only when they identify high risks that cannot be mitigated; reporting is not automatic or always mandatory.
- B. DPIAs are not required to be published to the public; they are internal documentation that may be shared with regulators upon request.
- D. While DPIAs are typically required when processing involves risk, the requirement exists whether or not there is actual risk; they are required for high-risk processing as a preventive measure.
Question 31
How do privacy audits differ from privacy assessments?
Show answer and explanation
Correct answer: B. They are evidence-based.
Privacy audits are evidence-based evaluations that examine objective facts and documented evidence to determine compliance with privacy standards and regulations. Audits provide verifiable, factual findings rooted in evidence examination. Both audits and assessments can be binding or non-binding depending on context, can be based on standards, and can be conducted internally or externally. The distinguishing characteristic of audits is their rigorous, evidence-based methodology that produces findings grounded in documentary and observational proof.
Why the other options are wrong
- A. Both audits and assessments can be binding or non-binding depending on organizational requirements.
- C. Both audits and assessments are based on standards; this is not a distinguishing difference.
- D. Both audits and assessments can be conducted internally or externally; this is not what distinguishes them.
Question 32
What is most critical when outsourcing data destruction service?
Show answer and explanation
Correct answer: A. Obtain a certificate of data destruction.
Obtaining a certificate of data destruction is the most critical requirement when outsourcing data destruction because it provides documented proof that data was actually destroyed according to agreed standards. This certificate serves as evidence of compliance with data retention and destruction obligations. While on-site destruction (B) and annual audits (C) may provide additional assurance, they are not always practical or necessary if proper certification is obtained. Keeping an asset inventory of original data (D) contradicts the purpose of destruction.
Why the other options are wrong
- B. On-site destruction requirement is not always practical and not universally mandated.
- C. Annual audits provide assurance but certification of destruction is more critical for compliance.
- D. Keeping inventory of destroyed data defeats the purpose of the destruction service.
Question 33
Which of the following privacy frameworks are legally binding?
Show answer and explanation
Correct answer: A. Binding Corporate Rules (BCRs).
Binding Corporate Rules (BCRs) are legally binding agreements approved by data protection authorities that allow organizations to transfer personal data across borders within a corporate group. BCRs create enforceable legal obligations on all entities within the corporate structure. Generally Accepted Privacy Principles (GAPP) are guidelines but not legally binding. The APEC Privacy Framework is a set of voluntary principles without legal enforcement mechanisms. The OECD Guidelines are recommendations to member governments but are not legally binding on organizations.
Why the other options are wrong
- B. GAPP are voluntary privacy principles and best practices, not legally binding requirements.
- C. The APEC Privacy Framework consists of voluntary, non-binding principles for privacy protection.
- D. OECD Guidelines are recommendations to member countries but do not create legal obligations for organizations.
Question 34
SCENARIO Please use the following to answer the next question: As the Director of data protection for Consolidated Records Corporation, you are justifiably pleased with your accomplishments so far. Your hiring was precipitated by warnings from regulatory agencies following a series of relatively minor data breaches that could easily have been worse. However, you have not had a reportable incident for the three years that you have been with the company. In fact, you consider your program a model that others in the data storage industry may note in their own program development. You started the program at Consolidated from a jumbled mix of policies and procedures and worked toward coherence across departments and throughout operations. You were aided along the way by the program's sponsor, the vice president of operations, as well as by a Privacy Team that started from a clear understanding of the need for change. Initially, your work was greeted with little confidence or enthusiasm by the company's "old guard" among both the executive team and frontline personnel working with data and interfacing with clients. Through the use of metrics that showed the costs not only of the breaches that had occurred, but also projections of the costs that easily could occur given the current state of operations, you soon had the leaders and key decision-makers largely on your side. Many of the other employees were more resistant, but face-to-face meetings with each department and the development of a baseline privacy training program achieved sufficient "buy-in" to begin putting the proper procedures into place. Now, privacy protection is an accepted component of all current operations involving personal or protected data and must be part of the end product of any process of technological development. While your approach is not systematic, it is fairly effective. You are left contemplating: What must be done to maintain the program and develop it beyond just a data breach prevention program? How can you build on your success? What are the next action steps? Which of the following would be most effectively used as a guide to a systems approach to implementing data protection?
Show answer and explanation
Correct answer: D. International Organization for Standardization 27000 Series.
The ISO 27000 series, particularly ISO 27001 and ISO 27002, provides a comprehensive, systematic framework for implementing information security and data protection across organizations. This series specifically addresses information security management systems with a holistic approach covering governance, risk management, implementation, monitoring, and continuous improvement. For a director transitioning from tactical breach prevention to a mature, systematic data protection program, the ISO 27000 series offers the structured methodology needed to scale and systematize operations beyond reactive measures.
Why the other options are wrong
- A. Data Lifecycle Management Standards address specific handling phases but do not provide the comprehensive systems framework needed for organizational-wide implementation.
- B. The United Nations does not maintain a recognized Privacy Agency Standards framework applicable to organizational implementation.
- C. ISO 9000 series focuses on quality management systems generally, not specifically on information security and data protection governance.
Question 35
An executive for a multinational online retail company in the United States is looking for guidance in developing her company's privacy program beyond what is specifically required by law. What would be the most effective resource for the executive to consult?
Show answer and explanation
Correct answer: B. Industry frameworks.
Industry frameworks provide the most effective resource for developing a privacy program beyond legal minimums. Frameworks such as the NIST Privacy Framework, ISO 27001, or industry-specific standards offer established best practices, guidance, and benchmarks that help organizations develop comprehensive privacy programs aligned with their business context and industry norms.
Why the other options are wrong
- A. Internal auditors evaluate compliance but don't provide forward-looking guidance for developing privacy programs.
- C. Oversight organizations enforce requirements but typically don't provide detailed guidance for voluntary enhancements beyond legal requirements.
- D. Breach notifications from competitors are reactive data points that don't provide constructive guidance for building proactive privacy programs.
Question 36
What is the best way to understand the location, use and importance of personal data within an organization?
Show answer and explanation
Correct answer: A. By analyzing the data inventory.
A data inventory provides a comprehensive catalog of all personal data within an organization, documenting where data is located, how it is used, and its importance to business operations. This systematic documentation is the foundational approach to understanding data's role across the organization. Testing security systems evaluates protection mechanisms but not the location or importance of data itself. Evaluating collection methods addresses only how data enters the system, not its full scope. Employee interviews provide limited and subjective perspectives compared to a complete inventory.
Why the other options are wrong
- B. Security testing validates technical controls but does not reveal the location, use, or business importance of personal data.
- C. Collection methods only address how data is acquired, not where it resides, how it is used, or why it matters to the organization.
- D. Employee interviews provide anecdotal information but lack the comprehensive, systematic documentation necessary to understand the full data landscape.
Question 37
Incipia Corporation just trained the last of its 300 employees on their new privacy policies and procedures. If Incipia wanted to analyze the effectiveness of the training over the next 6 months, which form of trend analysis should they use?
Show answer and explanation
Correct answer: C. Statistical.
Statistical trend analysis is the appropriate method for measuring training effectiveness over a 6-month period. This involves collecting quantitative data on training outcomes (assessment scores, compliance rates, incident reductions, or awareness metrics) and analyzing patterns and trends in that data to determine whether training effectiveness is improving, declining, or remaining stable. Statistical analysis can identify correlations between training and behavioral or performance changes.
Why the other options are wrong
- A. Cyclical analysis examines recurring patterns based on seasons or time-based cycles, not appropriate for measuring a one-time training deployment's sustained effectiveness.
- B. Irregular trend analysis addresses anomalies and unexpected variations, not the systematic measurement of training program effectiveness.
- D. Standard variance measures deviation from a mean within a dataset but is not the primary term used for analyzing effectiveness trends over a monitoring period.
Question 38
Which of the following best demonstrates the effectiveness of a firm’s privacy incident response process?
Show answer and explanation
Correct answer: D. The decrease of mean time to resolve privacy incidents
The decrease of mean time to resolve privacy incidents best demonstrates the effectiveness of a firm's incident response process. Mean time to resolve (MTTR) directly measures how quickly the organization detects, contains, and resolves privacy incidents, which is the core function of an incident response process. A lower MTTR indicates the process is working well, minimizing damage and exposure duration. This metric reflects operational efficiency and process maturity.
Why the other options are wrong
- A. Decrease in total security breaches may result from preventive controls rather than incident response effectiveness.
- B. Notifiable breaches depend on incident severity and regulatory thresholds, not directly on response process quality.
- C. Increased reporting may indicate improved awareness or culture rather than process effectiveness; more reports could indicate worse incidents.
Question 39
SCENARIO Please use the following to answer the next question: As the Director of data protection for Consolidated Records Corporation, you are justifiably pleased with your accomplishments so far. Your hiring was precipitated by warnings from regulatory agencies following a series of relatively minor data breaches that could easily have been worse. However, you have not had a reportable incident for the three years that you have been with the company. In fact, you consider your program a model that others in the data storage industry may note in their own program development. You started the program at Consolidated from a jumbled mix of policies and procedures and worked toward coherence across departments and throughout operations. You were aided along the way by the program's sponsor, the vice president of operations, as well as by a Privacy Team that started from a clear understanding of the need for change. Initially, your work was greeted with little confidence or enthusiasm by the company's "old guard" among both the executive team and frontline personnel working with data and interfacing with clients. Through the use of metrics that showed the costs not only of the breaches that had occurred, but also projections of the costs that easily could occur given the current state of operations, you soon had the leaders and key decision-makers largely on your side. Many of the other employees were more resistant, but face-to-face meetings with each department and the development of a baseline privacy training program achieved sufficient "buy-in" to begin putting the proper procedures into place. Now, privacy protection is an accepted component of all current operations involving personal or protected data and must be part of the end product of any process of technological development. While your approach is not systematic, it is fairly effective. You are left contemplating: What must be done to maintain the program and develop it beyond just a data breach prevention program? How can you build on your success? What are the next action steps? What stage of the privacy operational life cycle best describes the company’s current privacy program?
Show answer and explanation
Correct answer: D. Sustain.
The company has moved beyond the initial breach response phase and has established a mature, operational privacy program integrated into all business processes. They are now at the Sustain stage, where the focus shifts to maintaining the program, continuous improvement, and evolving beyond basic breach prevention. The director is contemplating how to maintain and develop the program further, which is the core concern of the Sustain phase.
Why the other options are wrong
- A. Assess would involve evaluating the current state and identifying gaps, which was completed during the initial program development.
- B. Protect involves implementing controls and procedures, which has already been accomplished and is now embedded in operations.
- C. Respond relates to incident handling and breach management, not to maintaining and advancing an established program.
Question 40
Which is NOT an influence on the privacy environment external to an organization?
Show answer and explanation
Correct answer: A. Management team priorities.
Management team priorities are internal to an organization and represent an internal influence on the privacy environment. Management decisions about resource allocation, strategic direction, and privacy program emphasis come from within the organization's leadership structure. Regulations are external legal requirements imposed by governments and regulatory bodies. Consumer demand is an external market force reflecting expectations and preferences outside the organization. Technological advances are external developments in the technology industry that affect organizational capabilities and risks.
Why the other options are wrong
- B. Regulations are external requirements imposed by governments, regulatory agencies, and legal jurisdictions outside organizational control.
- C. Consumer demand is an external market force created by customers and market participants outside the organization.
- D. Technological advances are external developments in the technology industry and market that originate outside the organization.
Question 41
Formosa International operates in 20 different countries including the United States and France. What organizational approach would make complying with a number of different regulations easier?
Show answer and explanation
Correct answer: C. Rationalizing requirements.
Rationalizing requirements is the organizational approach that makes compliance with multiple different regulations easier. By identifying overlapping requirements, commonalities, and areas where one control satisfies multiple regulatory frameworks, an organization can streamline its compliance program and reduce redundancy. This approach allows Formosa International to build a unified privacy program that addresses the core requirements across all 20 jurisdictions while minimizing duplication of effort.
Why the other options are wrong
- A. Data mapping documents where data flows but does not inherently simplify compliance with multiple regulations.
- B. Fair Information Practices are general principles that provide guidance but do not make compliance with specific regulations easier.
- D. De-centralized privacy management would fragment compliance efforts and make coordination across 20 countries harder, not easier.
Question 42
What is the main purpose of a privacy program audit?
Show answer and explanation
Correct answer: D. To ensure the adequacy of data protection procedures.
The primary purpose of a privacy program audit is to evaluate and ensure the adequacy of data protection procedures and controls. Audits assess whether the organization's privacy safeguards are sufficient, identify gaps in protection mechanisms, and verify compliance with applicable standards and regulations.
Why the other options are wrong
- A. While audits may reveal vulnerabilities, mitigating breach effects is a remedial action, not the audit's purpose.
- B. Justifying budget increases is a potential benefit but not the main purpose of conducting audits.
- C. Decisions on staff roles and responsibilities should be driven by organizational needs, not audit findings.
Question 43
How are individual program needs and specific organizational goals identified in privacy framework development?
Show answer and explanation
Correct answer: D. Through creation of the business case.
The creation of a business case is the foundational step that identifies both individual program needs and specific organizational goals in privacy framework development. A business case articulates the rationale, objectives, and alignment between privacy initiatives and organizational strategy, making it the primary vehicle for identifying what the organization needs and what it aims to achieve. This approach ensures privacy efforts are tied to measurable business outcomes and strategic priorities.
Why the other options are wrong
- A. Metrics align existing objectives but do not initially identify what those needs and goals are.
- B. Internal conversations with the privacy team alone lack the structured approach needed to identify organizational goals systematically.
- C. An industry-standard needs analysis provides a template but does not customize identification to the specific organization's individual needs and goals.
Question 44
A Human Resources director at a company reported that a laptop containing employee payroll data was lost on the train. Which action should the company take IMMEDIATELY?
Show answer and explanation
Correct answer: B. Wipe the hard drive remotely
When sensitive data is lost or stolen, the immediate technical action must be to prevent unauthorized access to that data. Remote wiping of the hard drive renders the data inaccessible and eliminates the risk of exfiltration or misuse, which is the most urgent containment measure. This must happen before other steps like reporting to law enforcement or management, as it directly stops the threat from being exploited.
Why the other options are wrong
- A. Reporting to law enforcement is important but secondary to stopping the threat from being actively exploited.
- C. Reporting to senior management, while necessary, does not address the immediate technical threat and can be done simultaneously with containment.
- D. Risk analysis is a deliberative process that takes time; immediate containment cannot wait for a comprehensive analysis to be completed.
Question 45
SCENARIO Please use the following to answer the next question: Your organization, the Chicago (U.S.)-based Society for Urban Greenspace, has used the same vendor to operate all aspects of an online store for several years. As a small nonprofit, the Society cannot afford the higher-priced options, but you have been relatively satisfied with this budget vendor, Shopping Cart Saver (SCS). Yes, there have been some issues. Twice, people who purchased items from the store have had their credit card information used fraudulently subsequent to transactions on your site, but in neither case did the investigation reveal with certainty that the Society’s store had been hacked. The thefts could have been employee-related. Just as disconcerting was an incident where the organization discovered that SCS had sold information it had collected from customers to third parties. However, as Jason Roland, your SCS account representative, points out, it took only a phone call from you to clarify expectations and the “misunderstanding” has not occurred again. As an information-technology program manager with the Society, the role of the privacy professional is only one of many you play. In all matters, however, you must consider the financial bottom line. While these problems with privacy protection have been significant, the additional revenues of sales of items such as shirts and coffee cups from the store have been significant. The Society’s operating budget is slim, and all sources of revenue are essential. Now a new challenge has arisen. Jason called to say that starting in two weeks, the customer data from the store would now be stored on a data cloud. “The good news,” he says, “is that we have found a low-cost provider in Finland, where the data would also be held. So, while there may be a small charge to pass through to you, it won’t be exorbitant, especially considering the advantages of a cloud.” You begin to research and discover that a number of the leading cloud service providers have signed a letter of intent to work together on shared conventions and technologies for privacy protection. You make a note to find out if Jason’s Finnish provider is signing on. What process can best answer your questions about the vendor’s data security safeguards?
Show answer and explanation
Correct answer: A. A second-party of supplier audit
A second-party audit (conducted by the organization itself or on its behalf) directly examines the vendor's data security safeguards, controls, and practices. This provides firsthand verification of security measures and compliance with privacy protection standards. Reference checks provide limited anecdotal evidence, tabletop demonstrations address threat response but not safeguard verification, and public records searches reveal only legal violations without assessing actual security infrastructure.
Why the other options are wrong
- B. Reference checks provide only subjective feedback and do not systematically evaluate technical safeguards.
- C. A tabletop demonstration tests incident response but does not assess the vendor's actual data security safeguards.
- D. A public records search reveals past legal violations but does not answer questions about current data security practices.
Question 46
Which of the following is TRUE about a PIA (Privacy Impact Analysis)?
Show answer and explanation
Correct answer: C. The PIA must be conducted at the early stages of the project lifecycle
A PIA (Privacy Impact Analysis) must be conducted at the early stages of the project lifecycle. Conducting the analysis early allows organizations to identify privacy risks and implement privacy protections during the design phase rather than attempting remediation after systems are built. This aligns with privacy-by-design principles and enables proactive risk mitigation before significant resources are committed.
Why the other options are wrong
- A. Not every project involving personal data requires a PIA; risk-based approaches determine which projects warrant this analysis.
- B. A DPIA (Data Protection Impact Assessment) may include elements of a PIA, but a PIA does not necessarily encompass a full DPIA.
- D. While previous audit results may inform a PIA, this is not a defining characteristic of the PIA process itself.
Question 47
Which of the following best describes proper compliance for an international organization using Binding Corporate Rules (BCRs) as a controller or processor?
Show answer and explanation
Correct answer: B. All employees are subject to the rules in their entirety, regardless of where the work is taking place.
Binding Corporate Rules (BCRs) function as internal corporate policies that bind all employees of the organization across all jurisdictions where the organization operates. Employees are subject to the rules in their entirety regardless of where their work is physically located. This is the defining feature of BCRs, they create a uniform, organization-wide standard for data protection that overrides local jurisdictional variation and eliminates the need for repeated ad hoc agreements for each data transfer.
Why the other options are wrong
- A. BCRs eliminate the need for ad hoc contractual agreements for each data transfer; they provide standing authorization.
- C. Employees do not follow multiple regulatory frameworks based on work location; BCRs create a single unified standard applicable globally.
- D. Employees who control personal data are not exempt from legal enforcement; BCRs do not provide exemptions from applicable law.
Question 48
SCENARIO Please use the following to answer the next question: Today is your first day at a fast growing international real estate firm headquartered in New York, with offices in Canada and Germany. You are the firm's first ever privacy officer. While touring the office to meet your new colleagues and learn the layout of the office, you notice piles of printing jobs left on the printer in the copy room. You also note a recycle bin and garbage can near the printers. With a quick glance, you see a completed loan application form print out with applicant name, social security number and home address lying in the recycle bin. You make a note to follow up immediately. You are then introduced to the head of IT who gives you a warm welcome and explains his star project this year - enterprise CRM (Customer Relationship Management) mobility. He is very proud that he is leading this innovation that allows firm-wide employees to access the existing CRM database remotely from anywhere on the Internet. The business value of this mobility initiative is significant. Since he doesn't have internal web development expertise, he outsourced the development work to a small IT firm in New York that has just successfully delivered another IT initiative for the company. After the tour you start working on a plan based on your observations. One immediate action is to schedule a meeting with the head of IT to discuss the CRM mobility project. All of the following should be mandatory in the contract for the outsourced vendor EXCEPT?
Show answer and explanation
Correct answer: A. Generation of reports and metrics.
While generation of reports and metrics is useful for monitoring and governance, it is not mandatory in vendor contracts for a CRM mobility system. Information security controls are mandatory to protect database access and sensitive customer data in a remote environment. Liability clauses ensure the vendor bears responsibility for data breaches caused by their negligence or failure. Cyber insurance provides financial protection and demonstrates the vendor's commitment to risk management. All three of these are critical safeguards for a project involving remote access to sensitive customer relationship data, whereas reporting metrics are operational enhancements rather than mandatory protections.
Why the other options are wrong
- B. Information security controls are mandatory for a system providing remote internet access to customer data.
- C. Liability for data breach is essential to establish vendor accountability for security failures.
- D. Cyber insurance is important to verify the vendor maintains financial protection for potential breaches.
Question 49
An organization is establishing a mission statement for its privacy program. Which of the following statements would be the best to use?
Show answer and explanation
Correct answer: C. The goal of the privacy program is to protect the privacy of all individuals who support our organization. To meet this goal, we must work to comply with all applicable privacy laws.
A sound privacy mission statement clearly articulates the core purpose: protecting privacy for affected individuals while ensuring compliance with applicable laws. Option C provides a focused, realistic, and implementable mission without overpromising results or including irrelevant historical narrative. Option A makes an unrealistic absolute claim about stopping all breaches, Option B includes unrelated disaster context and geographic specificity, and Option D confuses mission with specific metrics and tactics.
Why the other options are wrong
- A. Promising to stop all data breaches is unrealistic and overstates what a privacy program can achieve.
- B. Including historical disaster narratives and geographic concerns dilutes the privacy mission focus.
- D. Mixing specific percentages, training requirements, and inventory mandates conflates mission statement with operational tactics.
Question 50
An organization's business continuity plan or disaster recovery plan does NOT typically include what?
Show answer and explanation
Correct answer: D. Retention schedule for storage and destruction of information.
Business continuity and disaster recovery plans focus on operational resilience, including recovery objectives, emergency response procedures, and organizational roles during disruption. A retention schedule for storage and destruction of information is an element of records management and information governance policies, not typically integrated into continuity or recovery plans. Recovery time objectives (option A) define how quickly systems must resume. Emergency response guidelines (option B) specify how to respond to incidents. Organizational responsibilities (option C) clarify roles during recovery. Option D describes records lifecycle management, which is separate from continuity planning.
Why the other options are wrong
- A. Recovery time objectives are core components of business continuity and disaster recovery plans.
- B. Emergency response guidelines are essential elements of continuity and disaster recovery planning.
- C. Clear statements of organizational responsibilities and roles are fundamental to effective continuity and recovery planning.
Question 51
Which of the following is NOT typically a function of a Privacy Officer?
Show answer and explanation
Correct answer: A. Managing an organization's information security infrastructure.
A Privacy Officer's core functions include serving as an interdepartmental liaison for privacy matters, monitoring compliance with privacy laws, and responding to access requests. Managing information security infrastructure is typically the responsibility of a Chief Information Security Officer (CISO) or IT security team, not the Privacy Officer. While privacy and security overlap, infrastructure management falls outside the Privacy Officer's traditional scope.
Why the other options are wrong
- B. Privacy officers regularly serve as liaisons between departments on privacy issues.
- C. Monitoring compliance with privacy laws is a primary responsibility of privacy officers.
- D. Responding to information access requests is a core function of privacy professionals.
Question 52
If a privacy professional wants to show that an organization's privacy program is working as intended, the professional should?
Show answer and explanation
Correct answer: C. Collect and analyze privacy program metrics.
To demonstrate that a privacy program is working as intended, a privacy professional should collect and analyze privacy program metrics. Metrics provide quantifiable evidence of program effectiveness, including data on breach incidents, employee training completion rates, policy adherence, incident response times, and privacy impact assessments completed. This data-driven approach provides objective evidence of the program's performance. Customer feedback alone may be subjective and incomplete. A tabletop exercise tests readiness but does not demonstrate ongoing program effectiveness. Reviewing policies shows governance but not actual performance outcomes.
Why the other options are wrong
- A. Customer feedback provides anecdotal information but does not provide systematic evidence of program effectiveness.
- B. A tabletop exercise is a preparedness tool for testing response procedures, not a measure of ongoing program performance.
- D. Policy review demonstrates governance documents exist but does not show whether the program is actually functioning as intended.
Question 53
What is the main reason to begin with 3-5 key metrics during the program development process?
Show answer and explanation
Correct answer: B. To keep the focus on the main organizational objectives.
Starting with 3-5 key metrics during program development keeps the focus on main organizational objectives rather than diluting efforts across numerous measurements. A limited set of meaningful metrics ensures the program stays aligned with strategic priorities and avoids the paralysis of tracking too many indicators that may not directly support business goals.
Why the other options are wrong
- A. While limiting metrics may reduce costs, cost avoidance is not the primary reason for this practice.
- C. Minimizing selective data use is unrelated to choosing a specific number of metrics.
- D. The number of metrics tracked does not directly determine how many people must be involved in the program.
Question 54
When supporting the business and data privacy program expanding into a new jurisdiction, it is important to do all of the following EXCEPT?
Show answer and explanation
Correct answer: B. Appoint a new Privacy Officer (PO) for that jurisdiction.
Appointing a new Privacy Officer specifically for a new jurisdiction is not necessary when expanding into a new area. The organization's existing Privacy Officer can oversee compliance in multiple jurisdictions, potentially with local legal counsel or data protection specialists supporting jurisdiction-specific requirements. Identifying stakeholders provides necessary input and coordination. Performing a legal assessment determines what regulations apply in the new jurisdiction. Considering cultural factors ensures the privacy framework adapts to local norms and expectations. These three elements directly support successful expansion; appointing a separate Privacy Officer for each jurisdiction is an administrative choice rather than a mandatory requirement.
Why the other options are wrong
- A. Identifying stakeholders is essential for coordination and understanding local business needs.
- C. Assessing applicable laws determines compliance obligations specific to that jurisdiction.
- D. Considering culture ensures privacy practices align with local values and expectations.
Question 55
Which of the following is the optimum first step to take when creating a Privacy Officer governance model?
Show answer and explanation
Correct answer: A. Involve senior leadership.
Involving senior leadership is the optimum first step when creating a Privacy Officer governance model because privacy initiatives require organizational commitment, resource allocation, and strategic direction that only leadership can provide. Without executive sponsorship and understanding, privacy programs lack authority, funding, and organizational prioritization. Partnerships with IT and communications are important operational steps that follow after establishing leadership alignment. General Counsel involvement and public affairs collaboration are secondary considerations once the governance structure and reporting lines are defined at the senior level.
Why the other options are wrong
- B. Providing flexibility to General Counsel comes after establishing the core governance model with leadership.
- C. Internal partnerships with IT and information security follow after senior leadership establishes the privacy function.
- D. Leveraging communications teams is a supporting activity that occurs after governance structure is determined.
Question 56
Read the following steps: Perform frequent data backups. Perform test restorations to verify integrity of backed-up data. Maintain backed-up data offline or on separate servers. These steps can help an organization recover from what?
Show answer and explanation
Correct answer: C. Ransomware attacks
Ransomware attacks encrypt an organization's data and render systems unusable until a ransom is paid or recovery alternatives exist. Frequent offline backups with tested restoration procedures are the primary defense against ransomware, as they allow an organization to restore systems to a known good state without paying attackers. Offline or separate server storage ensures backups cannot be encrypted by the same malware affecting primary systems.
Why the other options are wrong
- A. Phishing attacks target user credentials and social engineering; backups do not directly prevent or recover from phishing.
- B. Authorization errors are configuration or access control mistakes; backups do not prevent these errors from occurring.
- D. Stolen encryption keys compromise cryptographic systems; backups alone do not recover from key theft without additional key management controls.
Question 57
SCENARIO Please use the following to answer the next question: John is the new privacy officer at the prestigious international law firm, A&M LLP. A&M LLP is very proud of its reputation in the practice areas of Trusts & Estates and Merger & Acquisition in both U.S. and Europe. During lunch with a colleague from the Information Technology department, John heard that the Head of IT, Derrick, is about to outsource the firm's email continuity service to their existing email security vendor, MessageSafe. Being successful as an email hygiene vendor, MessageSafe is expanding its business by leasing cloud infrastructure from Cloud Inc. to host email continuity service for A&M LLP. John is very concerned about this initiative. He recalled that MessageSafe was in the news six months ago due to a security breach. Immediately, John did a quick research of MessageSafe's previous breach and learned that the breach was caused by an unintentional mistake by an IT administrator. He scheduled a meeting with Derrick to address his concerns. At the meeting, Derrick emphasized that email is the primary method for the firm's lawyers to communicate with clients, thus it is critical to have the email continuity service to avoid any possible email downtime. Derrick has been using the anti-spam service provided by MessageSafe for five years and is very happy with the quality of service provided by MessageSafe. In addition to the significant discount offered by MessageSafe, Derrick emphasized that he can also speed up the onboarding process since the firm already has a service contract in place with MessageSafe. The existing on-premises email continuity solution is about to reach its end of life very soon and he doesn't have the time or resource to look for another solution. Furthermore, the off-premises email continuity service will only be turned on when the email service at A&M LLP's primary and secondary data centers are both down, and the email messages stored at MessageSafe site for continuity service will be automatically deleted after 30 days. Which of the following is NOT an obligation of MessageSafe as the email continuity service provider for A&M LLP?
Show answer and explanation
Correct answer: C. Certifications to relevant frameworks.
Certifications to relevant frameworks (such as ISO 27001, SOC 2, or other compliance certifications) are not obligations that MessageSafe must fulfill as an email continuity service provider. While certifications can be valuable indicators of security maturity, they are not legally required obligations. In contrast, privacy compliance, security commitment, and breach notification to A&M LLP are all direct obligations of MessageSafe as a service provider handling client data.
Why the other options are wrong
- A. Privacy compliance is a core obligation of any service provider handling personal data.
- B. Security commitment is a fundamental obligation of any service provider, especially one handling sensitive firm data.
- D. Data breach notification to A&M LLP is an obligation under GDPR and standard data protection laws, as well as contractual data processing agreements.
Question 58
The General Data Protection Regulation (GDPR) specifies fines that may be levied against data controllers for certain infringements. Which of the following will be subject to administrative fines of up to 10 000 000 EUR, or in the case of an undertaking, up to 2% of the total worldwide annual turnover of the preceding financial year?
Show answer and explanation
Correct answer: B. Failure to implement technical and organizational measures to ensure data protection is enshrined by design and default
Under GDPR Article 83(4), the higher fine threshold of up to €10 million or 2% of global annual turnover applies to violations of data protection principles, including failure to implement technical and organizational measures for data protection by design and by default. This reflects the importance of proactive security measures. The other options describe violations that fall under the lower fine category (Article 83(3)) of up to €20 million or 4% of turnover, depending on severity.
Why the other options are wrong
- A. Failure to demonstrate consent is a violation under Article 83(3), subject to the higher fine tier.
- C. Incompatible processing of personal data is a violation under Article 83(3), subject to the higher fine tier.
- D. Failure to provide rectification rights is a violation under Article 83(3), subject to the higher fine tier.
Question 59
Which of the following indicates you have developed the right privacy framework for your organization?
Show answer and explanation
Correct answer: B. It improves the consistency of the privacy program.
A well-developed privacy framework's primary indicator of success is that it improves consistency across the privacy program. Consistency ensures uniform application of privacy principles and controls across all departments, systems, and operations, which was explicitly achieved at Consolidated Records through coherent policies and procedures.
Why the other options are wrong
- A. While privacy assessments are important components, their mere existence does not indicate the framework itself is right for the organization.
- C. A framework's effectiveness at another organization does not validate that it is appropriate for your specific organizational context, structure, and needs.
- D. Identifying stakeholders by name is an administrative task that does not measure whether the framework is achieving its privacy protection and operational objectives.
Question 60
What is the main purpose in notifying data subjects of a data breach?
Show answer and explanation
Correct answer: D. To allow individuals to take any actions required to protect themselves from possible consequences
The primary purpose of notifying data subjects about a breach is to empower them to take protective action. When individuals know their data has been compromised, they can monitor accounts, change passwords, place fraud alerts, dispute unauthorized charges, and take other preventive measures. This directly serves the affected individuals' interests and gives them agency in protecting themselves from harm, which is the core ethical and legal obligation.
Why the other options are wrong
- A. While avoiding penalties is a business consequence, it is not the purpose of the notification itself; the purpose is individual protection.
- B. Regulatory trend information may be a secondary benefit, but regulators are notified separately; the notification to data subjects is for their protection.
- C. Accountability for security sufficiency is an organizational governance matter, not the purpose of notifying data subjects about a specific breach.
Question 61
SCENARIO Please use the following to answer the next question. Manasa is a product manager at Omnipresent Omnimedia, where she is responsible for leading the development of the company’s flagship product, the Handy Helper. The Handy Helper is an application that can be used in the home to manage family calendars, do online shopping, and schedule doctor appointments. After having had a successful launch in the United States, the Handy Helper is about to be made available for purchase worldwide. The packaging and user guide for the Handy Helper indicate that it is a “privacy friendly” product suitable for the whole family, including children, but does not provide any further detail or privacy notice. In order to use the application, a family creates a single account, and the primary user has access to all information about the other users. Upon start up, the primary user must check a box consenting to receive marketing emails from Omnipresent Omnimedia and selected marketing partners in order to be able to use the application. Sanjay, the head of privacy at Omnipresent Omnimedia, was working on an agreement with a European distributor of Handy Helper when he fielded many questions about the product from the distributor. Sanjay needed to look more closely at the product in order to be able to answer the questions as he was not involved in the product development process. In speaking with the product team, he learned that the Handy Helper collected and stored all of a user’s sensitive medical information for the medical appointment scheduler. In fact, all of the user’s information is stored by Handy Helper for the additional purpose of creating additional products and to analyze usage of the product. This data is all stored in the cloud and is encrypted both during transmission and at rest. Consistent with the CEO’s philosophy that great new product ideas can come from anyone, all Omnipresent Omnimedia employees have access to user data under a program called “Eureka.” Omnipresent Omnimedia is hoping that at some point in the future, the data will reveal insights that could be used to create a fully automated application that runs on artificial intelligence, but as of yet, Eureka is not well-defined and is considered a long-term goal. What security controls are missing from the Eureka program?
Show answer and explanation
Correct answer: B. Data access is not limited to those who “need to know” for their role
The Eureka program grants all employees access to sensitive user data without restriction based on job role or necessity. Fundamental data protection requires that access be limited to personnel who need the data to perform their specific functions. Unrestricted employee access to medical information, payment details, and family calendar data violates the principle of least privilege and increases the risk of unauthorized use, misuse, or accidental exposure.
Why the other options are wrong
- A. Cloud storage of medical data is permissible under GDPR if appropriate technical and organizational controls are implemented; encryption at rest and in transit are present.
- C. While undefined purposes do raise fairness concerns, the question specifically asks what security controls are missing from the Eureka program itself.
- D. Encryption at rest does not prevent users from exercising access or portability rights; encryption protects data but does not block legitimate access requests.
Question 62
SCENARIO Please use the following to answer the next question: As they company’s new chief executive officer, Thomas Goddard wants to be known as a leader in data protection. Goddard recently served as the chief financial officer of Hoopy.com, a pioneer in online video viewing with millions of users around the world. Unfortunately, Hoopy is infamous within privacy protection circles for its ethically questionable practices, including unauthorized sales of personal data to marketers. Hoopy also was the target of credit card data theft that made headlines around the world, as at least two million credit card numbers were thought to have been pilfered despite the company’s claims that “appropriate” data protection safeguards were in place. The scandal affected the company’s business as competitors were quick to market an increased level of protection while offering similar entertainment and media content. Within three weeks after the scandal broke, Hoopy founder and CEO Maxwell Martin, Goddard’s mentor, was forced to step down. Goddard, however, seems to have landed on his feet, securing the CEO position at your company, Medialite, which is just emerging from its startup phase. He sold the company’s board and investors on his vision of Medialite building its brand partly on the basis of industry-leading data protection standards and procedures. He may have been a key part of a lapsed or even rogue organization in matters of privacy but now he claims to be reformed and a true believer in privacy protection. In his first week on the job, he calls you into his office and explains that your primary work responsibility is to bring his vision for privacy to life. But you also detect some reservations. “We want Medialite to have absolutely the highest standards,” he says. “In fact, I want us to be able to say that we are the clear industry leader in privacy and data protection. However, I also need to be a responsible steward of the company’s finances. So, while I want the best solutions across the board, they also need to be cost effective.” You are told to report back in a week’s time with your recommendations. Charged with this ambiguous mission, you depart the executive suite, already considering your next steps. You give a presentation to your CEO about privacy program maturity. What does it mean to have a “managed” privacy program, according to the AICPA/CICA Privacy Maturity Model?
Show answer and explanation
Correct answer: C. Reviews are conducted to assess the effectiveness of the controls in place.
A "managed" privacy program in the AICPA/CICA Privacy Maturity Model includes conducting reviews to assess the effectiveness of controls in place. At this maturity level, processes are established and functioning, but the defining characteristic is the addition of monitoring and evaluation activities to ensure controls are working as intended. This represents the stage where effectiveness assessment and feedback mechanisms are introduced, distinguishing it from the "defined" level (where procedures are documented but not yet reviewed for effectiveness) and the "optimized" level (where continuous improvement is the focus).
Why the other options are wrong
- A. This describes the "repeatable" or "defined" maturity level where processes exist but may lack full documentation and complete coverage.
- B. Full documentation and complete implementation describe a higher level of maturity but do not specifically characterize the "managed" level.
- D. Regular review and continuous improvement describe the "optimized" maturity level, the highest stage of privacy program development.
Question 63
SCENARIO Please use the following to answer the next question: Manasa is a product manager at Omnipresent Omnimedia, where she is responsible for leading the development of the company's flagship product, the Handy Helper. The Handy Helper is an application that can be used in the home to manage family calendars, do online shopping, and schedule doctor appointments. After having had a successful launch in the United States, the Handy Helper is about to be made available for purchase worldwide. The packaging and user guide for the Handy Helper indicate that it is a "privacy friendly" product suitable for the whole family, including children, but does not provide any further detail or privacy notice. In order to use the application, a family creates a single account, and the primary user has access to all information about the other users. Upon start up, the primary user must check a box consenting to receive marketing emails from Omnipresent Omnimedia and selected marketing partners in order to be able to use the application. Sanjay, the head of privacy at Omnipresent Omnimedia, was working on an agreement with a European distributor of Handy Helper when he fielded many questions about the product from the distributor. Sanjay needed to look more closely at the product in order to be able to answer the questions as he was not involved in the product development process. In speaking with the product team, he learned that the Handy Helper collected and stored all of a user's sensitive medical information for the medical appointment scheduler. In fact, all of the user's information is stored by Handy Helper for the additional purpose of creating additional products and to analyze usage of the product. This data is all stored in the cloud and is encrypted both during transmission and at rest. Consistent with the CEO's philosophy that great new product ideas can come from anyone, all Omnipresent Omnimedia employees have access to user data under a program called Eureka. Omnipresent Omnimedia is hoping that at some point in the future, the data will reveal insights that could be used to create a fully automated application that runs on artificial intelligence, but as of yet, Eureka is not well-defined and is considered a long-term goal. What can Sanjay do to minimize the risks of offering the product in Europe?
Show answer and explanation
Correct answer: B. Sanjay should work with Manasa to review and remediate the Handy Helper as a gating item before it is released.
Sanjay should make remediation of the Handy Helper's privacy issues a gating requirement, a condition that must be met before the product launches in Europe. The product currently violates multiple privacy principles likely required under GDPR and other European regulations, including lack of proper consent mechanisms, insufficient data minimization, overly broad access rights, and unclear purposes. Addressing these issues before market entry is the most effective risk mitigation strategy. Claiming Privacy Shield certification would be fraudulent and insufficient given the product's documented deficiencies. Documenting the data life cycle creates visibility but does not remediate the underlying privacy violations. Writing a privacy policy without fixing the underlying system problems does not address the fundamental architectural and operational violations present.
Why the other options are wrong
- A. This approach would be misleading and does not address the significant privacy violations present in the Handy Helper's design and operation.
- C. Documenting data flows provides transparency but does not remediate the fundamental privacy violations that must be fixed before European launch.
- D. A privacy policy alone cannot cure architectural violations like overly broad data access, unclear secondary purposes, and problematic consent mechanisms.
Question 64
You would like your organization to be independently audited to demonstrate compliance with international privacy standards and to identify gaps for remediation. Which type of audit would help you achieve this objective?
Show answer and explanation
Correct answer: C. Third-party audit.
Third-party audits are conducted by independent external organizations not affiliated with the audited entity or its clients, providing objective assessment and external validation of compliance. This independence is essential for demonstrating compliance to external stakeholders and identifying genuine gaps. First-party audits (option A) are internal self-assessments lacking external credibility. Second-party audits (option B) involve clients or related parties, introducing bias. Fourth-party audits (option D) do not exist as a standard classification in audit frameworks. Third-party audits specifically fulfill the stated objective of independent verification against international privacy standards.
Why the other options are wrong
- A. First-party audits are internal and self-conducted, lacking the independence needed to demonstrate credibility to external parties.
- B. Second-party audits involve affiliated parties such as clients or business partners, reducing independence and objectivity.
- D. Fourth-party audits are not a recognized audit classification in standard frameworks.
Question 65
SCENARIO Please use the following to answer the next question: Ben works in the IT department of IgNight, Inc., a company that designs lighting solutions for its clients. Although IgNight's customer base consists primarily of offices in the US, some individuals have been so impressed by the unique aesthetic and energy-saving design of the light fixtures that they have requested IgNight's installations in their homes across the globe. One Sunday morning, while using his work laptop to purchase tickets for an upcoming music festival, Ben happens to notice some unusual user activity on company files. From a cursory review, all the data still appears to be where it is meant to be but he can't shake off the feeling that something is not right. He knows that it is a possibility that this could be a colleague performing unscheduled maintenance, but he recalls an email from his company's security team reminding employees to be on alert for attacks from a known group of malicious actors specifically targeting the industry. Ben is a diligent employee and wants to make sure that he protects the company but he does not want to bother his hard-working colleagues on the weekend. He is going to discuss the matter with this manager first thing in the morning but wants to be prepared so he can demonstrate his knowledge in this area and plead his case for a promotion. Going forward, what is the best way for IgNight to prepare its IT team to manage these kind of security events?
Show answer and explanation
Correct answer: A. Tabletop exercises.
Tabletop exercises are the most effective way to prepare IT teams to manage security events. These structured simulations allow teams to practice incident response procedures, decision-making, and coordination in a controlled environment without the pressure of an actual incident. Tabletop exercises specifically prepare teams to recognize, classify, and respond to the types of suspicious activity Ben encountered. They build muscle memory and institutional knowledge for handling security events.
Why the other options are wrong
- B. While a data inventory is important for security, it does not prepare the IT team to manage or respond to security events.
- C. IT security awareness training teaches general security practices but does not specifically prepare teams to execute incident response procedures and protocols.
- D. Communicating scheduled maintenance helps reduce false alarms but does not actively prepare the team to manage security events when they occur.
Question 66
What is the name for the privacy strategy model that describes delegated decision making?
Show answer and explanation
Correct answer: A. De-centralized.
De-centralized privacy strategy describes a model where decision-making authority is delegated to individual departments, business units, or regional offices rather than being consolidated in a central privacy function. This distributed approach allows decisions to be made closer to the affected data and operations.
Why the other options are wrong
- B. De-functionalized is not a recognized privacy strategy model terminology.
- C. Hybrid describes a combination of centralized and decentralized approaches, not specifically delegated decision-making.
- D. Matrix refers to organizational structure combining functional and project-based reporting lines, not a privacy strategy model descriptor.
Question 67
Data retention and destruction policies should meet all of the following requirements EXCEPT?
Show answer and explanation
Correct answer: C. Documentation related to audit controls (third-party or internal) should be saved in a non-permanent format by default.
Documentation related to audit controls should be saved in a permanent format to maintain compliance evidence and audit trail integrity, not in a non-permanent format. Audit documentation must be retained to demonstrate that proper controls were in place and functioning. Options A, B, and D are all correct requirements: destruction triggers and methods must be documented (A), data should be retained only as long as necessary (B), and policies must be aligned across functions (D). Option C contradicts best practices by suggesting audit documentation be non-permanent.
Why the other options are wrong
- A. Documenting destruction triggers and methods is a required component of retention policies.
- B. Limiting retention to the necessary period is a fundamental principle of data protection.
- D. Cross-functional policy alignment is essential to ensure consistent data handling practices.
Question 68
Which of the following best supports implementing controls to bring privacy policies into effect?
Show answer and explanation
Correct answer: D. The information technology (IT) group supporting and enhancing the privacy program and privacy policy by developing processes and controls.
The IT group is best positioned to implement controls that bring privacy policies into effect because they develop the technical and operational processes, systems, and controls that actually enforce privacy requirements in practice. IT creates the mechanisms through which privacy policies are operationalized, such as data access controls, encryption, logging systems, and workflow controls. While internal audit (A) tests effectiveness, legal (B) reviews policies, and leadership (C) establishes direction, it is IT that develops and enhances the actual supporting infrastructure and controls.
Why the other options are wrong
- A. Internal audit tests whether controls work but does not implement the controls themselves.
- B. Legal review ensures policy compliance with law but does not implement operational controls.
- C. Leadership establishes policies but the CIO does not directly implement technical controls.
Question 69
What is one reason the European Union has enacted more comprehensive privacy laws than the United States?
Show answer and explanation
Correct answer: D. To allow the free movement of data between member countries.
The European Union has enacted more comprehensive privacy laws to allow the free movement of data between member countries. The GDPR and predecessor directives established privacy protections as a foundational requirement to enable the single digital market and free flow of data within the EU, treating privacy as essential infrastructure for economic integration.
Why the other options are wrong
- A. Ensuring enforcement is a mechanism, not the primary reason for comprehensive privacy laws.
- B. Privacy laws don't directly address funding for enforcement agencies; this is a separate budgetary matter.
- C. EU law moves toward harmonized standards rather than allowing separate industry standards, which would fragment the market.
Question 70
Which of the following actions is NOT required during a data privacy diligence process for Merger & Acquisition (M&A) deals?
Show answer and explanation
Correct answer: B. Update business processes to handle Data Subject Requests (DSRs).
During M&A privacy diligence, updating business processes to handle Data Subject Requests is not required as a diligence step; it is an operational implementation decision made after the merger closes. The actual diligence process requires revising application and data mapping inventories (A), comparing original versus post-merger data usage (C), and assessing privacy readiness before closing (D). These steps evaluate privacy risks and compliance status during the transaction evaluation phase.
Why the other options are wrong
- A. Revising application inventory and data mapping is essential for understanding inherited data assets.
- C. Comparing original to post-merger data usage is critical for identifying new compliance obligations.
- D. Privacy readiness assessment before the deal is necessary to understand risk exposure.
Question 71
Rationalizing requirements in order to comply with the various privacy requirements required by applicable law and regulation does NOT include which of the following?
Show answer and explanation
Correct answer: B. Implementing a solution that significantly addresses shared obligations and privacy rights.
Rationalizing privacy requirements involves systematically addressing multiple regulatory obligations to create a cohesive compliance approach. Implementing a solution that significantly addresses shared obligations is an outcome or result, not part of the rationalization process itself. Rationalization includes harmonizing requirements across regulations, applying appropriate standards, and handling outliers, but the actual implementation of a solution is the step that follows rationalization.
Why the other options are wrong
- A. Harmonizing shared obligations across varying legislation is a core component of requirements rationalization.
- C. Applying the strictest standard that maintains compliance across all jurisdictions is a key rationalization technique for multi-regulatory environments.
- D. Addressing case-by-case outliers that fall outside common obligations is part of the comprehensive rationalization process.
Question 72
What is the function of the privacy operational life cycle?
Show answer and explanation
Correct answer: B. It allows the organization to respond to ever-changing privacy demands
The privacy operational life cycle enables organizations to continuously respond to evolving privacy demands, regulatory changes, and emerging threats. It is a dynamic process that accommodates change rather than a static framework. Initial planning alone is insufficient for ongoing operations, retiring policies on fixed schedules is arbitrary and potentially dangerous, and privacy frameworks should remain adaptive rather than maturing into fixed forms.
Why the other options are wrong
- A. Establishing initial plans is important but does not capture the ongoing responsive nature of the lifecycle.
- C. Fixed retirement schedules for policies ignore the continuous need to respond to changing requirements.
- D. Privacy policies should remain flexible and responsive, not mature into fixed, unchanging forms.
Question 73
For an organization that has just experienced a data breach, what might be the least relevant metric for a company's privacy and governance team?
Show answer and explanation
Correct answer: B. The number of privacy rights requests that have been exercised.
The number of privacy rights requests exercised is the least relevant metric for a company's privacy and governance team following a data breach. While monitoring privacy rights requests has value for general program assessment, it does not directly address breach response, remediation, or prevention, the immediate priorities after an incident. Security patches, Privacy Impact Assessments, and employee training directly mitigate breach risks and support incident recovery, making them far more relevant post-breach.
Why the other options are wrong
- A. Security patches directly address vulnerabilities that may have enabled the breach and prevent future incidents.
- C. Privacy Impact Assessments help identify vulnerabilities and strengthen systems post-breach.
- D. Employee data awareness training is critical to preventing future breaches through human error or negligence.
Question 74
What is the key factor that lays the foundation for all other elements of a privacy program?
Show answer and explanation
Correct answer: C. A privacy mission statement
A privacy mission statement establishes the foundational purpose, principles, and direction for the entire privacy program. It articulates the organization's commitment to privacy protection and guides all other program elements, from team structure to regulatory compliance strategies. Without a clear mission statement, the program lacks coherent direction.
Why the other options are wrong
- A. Applicable regulations inform the program but do not establish its foundational purpose.
- B. Team structure is built after the mission is defined, not as the foundation.
- D. A responsible stakeholder is necessary but implements the mission rather than laying its foundation.
Question 75
SCENARIO Please use the following to answer the next question: As the Director of data protection for Consolidated Records Corporation, you are justifiably pleased with your accomplishments so far. Your hiring was precipitated by warnings from regulatory agencies following a series of relatively minor data breaches that could easily have been worse. However, you have not had a reportable incident for the three years that you have been with the company. In fact, you consider your program a model that others in the data storage industry may note in their own program development. You started the program at Consolidated from a jumbled mix of policies and procedures and worked toward coherence across departments and throughout operations. You were aided along the way by the program's sponsor, the vice president of operations, as well as by a Privacy Team that started from a clear understanding of the need for change. Initially, your work was greeted with little confidence or enthusiasm by the company's "old guard" among both the executive team and frontline personnel working with data and interfacing with clients. Through the use of metrics that showed the costs not only of the breaches that had occurred, but also projections of the costs that easily could occur given the current state of operations, you soon had the leaders and key decision-makers largely on your side. Many of the other employees were more resistant, but face-to-face meetings with each department and the development of a baseline privacy training program achieved sufficient "buy-in" to begin putting the proper procedures into place. Now, privacy protection is an accepted component of all current operations involving personal or protected data and must be part of the end product of any process of technological development. While your approach is not systematic, it is fairly effective. You are left contemplating: What must be done to maintain the program and develop it beyond just a data breach prevention program? How can you build on your success? What are the next action steps? What practice would afford the Director the most rigorous way to check on the program's compliance with laws, regulations and industry best practices?
Show answer and explanation
Correct answer: A. Auditing.
Auditing provides the most rigorous and comprehensive method to verify compliance with laws, regulations, and industry best practices. Audits involve systematic examination of policies, procedures, and controls against established standards and regulatory requirements, providing formal documentation and evidence of compliance status.
Why the other options are wrong
- B. Monitoring is continuous observation but lacks the formal, structured rigor of auditing and may not comprehensively assess regulatory compliance.
- C. Assessment is broader and less structured than auditing; it identifies gaps and vulnerabilities but doesn't provide the same level of formal compliance verification.
- D. Forensics is investigative and reactive, focused on analyzing incidents after they occur rather than proactively checking ongoing compliance.
Question 76
Under the General Data Protection Regulation (GDPR), which of the following situations would LEAST likely require a controller to notify a data subject?
Show answer and explanation
Correct answer: A. An encrypted USB key with sensitive personal data is stolen
Under GDPR Article 34, notification is not required if the personal data has been protected by appropriate technical or organizational measures such that the risk to data subjects is unlikely. An encrypted USB key with sensitive data, if properly encrypted, presents minimal risk because the data cannot be accessed without the encryption key. If encryption is sufficiently robust, the controller may reasonably conclude that there is no real risk to individuals. The other scenarios involve visible or accessible personal data where individuals' identities or information are exposed or could be used, creating notification obligations.
Why the other options are wrong
- B. Sending personal data via cc field exposes recipients' email addresses to all other recipients, causing a breach that requires notification.
- C. Erroneous data sent to a wrong mailing list means personal data was disclosed to unauthorized recipients, requiring notification.
- D. Public publication of usernames, phone numbers, and purchase history online is a serious breach affecting user identification and financial information, requiring notification.
Question 77
Which of the following is NOT an important factor to consider when developing a data retention policy?
Show answer and explanation
Correct answer: C. Organizational culture.
Organizational culture, while important to overall change management and privacy program adoption, is not a primary factor in developing a data retention policy itself. Technology resources affect implementation capabilities and cost. Business requirements determine what data must be retained and for how long to support operations. Compliance requirements mandate minimum and maximum retention periods based on applicable laws. These three factors directly shape the retention policy's content and requirements, whereas culture influences how well the policy is adopted, not what the policy should contain.
Why the other options are wrong
- A. Technology resources determine the practical ability to implement automated retention and deletion systems.
- B. Business requirements establish what data needs to be retained to support operational needs.
- D. Compliance requirements mandate legal minimum and maximum retention periods across jurisdictions.
Question 78
SCENARIO Please use the following to answer the next question: It's just what you were afraid of. Without consulting you, the information technology director at your organization launched a new initiative to encourage employees to use personal devices for conducting business. The initiative made purchasing a new, high-specification laptop computer an attractive option, with discounted laptops paid for as a payroll deduction spread over a year of paychecks. The organization is also paying the sales taxes. It's a great deal, and after a month, more than half the organization's employees have signed on and acquired new laptops. Walking through the facility, you see them happily customizing and comparing notes on their new computers, and at the end of the day, most take their laptops with them, potentially carrying personal data to their homes or other unknown locations. It's enough to give you data-protection nightmares, and you've pointed out to the information technology Director and many others in the organization the potential hazards of this new practice, including the inevitability of eventual data loss or theft. Today you have in your office a representative of the organization's marketing department who shares with you, reluctantly, a story with potentially serious consequences. The night before, straight from work, with laptop in hand, he went to the Bull and Horn Pub to play billiards with his friends. A fine night of sport and socializing began, with the laptop "safely" tucked on a bench, beneath his jacket. Later that night, when it was time to depart, he retrieved the jacket, but the laptop was gone. It was not beneath the bench or on another bench nearby. The waitstaff had not seen it. His friends were not playing a joke on him. After a sleepless night, he confirmed it this morning, stopping by the pub to talk to the cleanup crew. They had not found it. The laptop was missing. Stolen, it seems. He looks at you, embarrassed and upset. You ask him if the laptop contains any personal data from clients, and, sadly, he nods his head, yes. He believes it contains files on about 100 clients, including names, addresses and governmental identification numbers. He sighs and places his head in his hands in despair. What should you do first to ascertain additional information about the loss of data?
Show answer and explanation
Correct answer: A. Interview the person reporting the incident following a standard protocol.
The first step in responding to a potential data loss incident is to interview the person reporting the incident following a standard protocol. This initial structured interview gathers essential facts: what data was on the device, when and where it was last seen, whether the employee had any security measures in place, and what steps were already taken. A standard protocol ensures consistent, thorough information gathering and prevents contamination of the investigation through leading questions or assumptions. Calling police before gathering facts wastes investigative resources and may be premature. Investigating the employee's background before understanding the incident is inappropriate and counterproductive. Checking backups is a later step, not the first priority.
Why the other options are wrong
- B. Involving police should follow initial fact-gathering and assessment; premature reporting wastes police resources on incidents that may not require criminal investigation.
- C. Investigating the employee's background before gathering incident facts is inappropriate and unnecessary unless evidence suggests intentional misconduct.
- D. Checking backup records is part of the assessment phase, but initial incident details must be gathered first to understand the scope of potential data loss.
Question 79
SCENARIO Please use the following to answer the next question: Paul Daniels, with years of experience as a CEO, is worried about his son Carlton's successful venture, Gadgo. A technological innovator in the communication industry that quickly became profitable, Gadgo has moved beyond its startup phase. While it has retained its vibrant energy, Paul fears that under Carlton's direction, the company may not be taking its risks or obligations as seriously as it needs to. Paul has hired you, a Privacy Consultant, to assess the company and report to both father and son. "Carlton won't listen to me," Paul says, "but he may pay attention to an expert." Gadgo's workplace is a clubhouse for innovation, with games, toys, snacks. espresso machines, giant fish tanks and even an iguana who regards you with little interest. Carlton, too, seems bored as he describes to you the company's procedures and technologies for data protection. It's a loose assemblage of controls, lacking consistency and with plenty of weaknesses. "This is a technology company," Carlton says. "We create. We innovate. I don't want unnecessary measures that will only slow people down and clutter their thoughts." The meeting lasts until early evening. Upon leaving, you walk through the office it looks as if a strong windstorm has recently blown through, with papers scattered across desks and tables and even the floor. A "cleaning crew" of one teenager is emptying the trash bins. A few computers have been left on for the night, others are missing. Carlton takes note of your attention to this: "Most of my people take their laptops home with them, or use their own tablets or phones. I want them to use whatever helps them to think and be ready day or night for that great insight. It may only come once!" What phase in the Privacy Maturity Model (PMM) does Gadgo's privacy program best exhibit?
Show answer and explanation
Correct answer: A. Ad hoc.
The Privacy Maturity Model's Ad Hoc phase is characterized by inconsistent processes, lack of standardization, reactive rather than proactive controls, and absence of formal documentation or governance. Gadgo exhibits all these traits: loose assemblage of controls lacking consistency, poor physical security awareness, no formal policies for remote work devices, scattered documentation on desks and floors, and reactive leadership that prioritizes innovation over systematic risk management. There is no evidence of defined processes, repeatability, or managed oversight.
Why the other options are wrong
- B. The Defined phase requires documented policies and procedures; Gadgo lacks this foundational structure.
- C. The Repeatable phase requires consistent, standardized processes that can be replicated; Gadgo's controls are ad hoc and inconsistent.
- D. The Managed phase requires monitoring, measurement, and control of processes; Gadgo shows no evidence of these capabilities.
Question 80
SCENARIO Please use the following to answer the next question: Edufox has hosted an annual convention of users of its famous e-learning software platform, and over time, it has become a grand event. It fills one of the large downtown conference hotels and overflows into the others, with several thousand attendees enjoying three days of presentations, panel discussions and networking. The convention is the centerpiece of the company's product rollout schedule and a great training opportunity for current users. The sales force also encourages prospective clients to attend to get a better sense of the ways in which the system can be customized to meet diverse needs and understand that when they buy into this system, they are joining a community that feels like family. This year's conference is only three weeks away, and you have just heard news of a new initiative supporting it: a smartphone app for attendees. The app will support late registration, highlight the featured presentations and provide a mobile version of the conference program. It also links to a restaurant reservation system with the best cuisine in the areas featured. "It's going to be great," the developer, Deidre Hoffman, tells you, "if, that is, we actually get it working!" She laughs nervously but explains that because of the tight time frame she'd been given to build the app, she outsourced the job to a local firm. "It's just three young people," she says, "but they do great work." She describes some of the other apps they have built. When asked how they were selected for this job, Deidre shrugs. "They do good work, so I chose them." Deidre is a terrific employee with a strong track record. That's why she's been charged to deliver this rushed project. You're sure she has the best interests of the company at heart, and you don't doubt that she's under pressure to meet a deadline that cannot be pushed back. However, you have concerns about the app's handling of personal data and its security safeguards. Over lunch in the break room, you start to talk to her about it, but she quickly tries to reassure you, "I'm sure with your help we can fix any security issues if we have to, but I doubt there'll be any. These people build apps for a living, and they know what they're doing. You worry too much, but that's why you're so good at your job!" You want to point out that normal protocols have NOT been followed in this matter. Which process in particular has been neglected?
Show answer and explanation
Correct answer: D. Vendor due diligence or vetting.
Vendor due diligence or vetting is the normal protocol that has been neglected in this scenario. The developer chose the vendor based solely on their prior work quality without conducting the standard evaluation process that typically includes security assessments, compliance verification, contractual review, and formal evaluation criteria. Due diligence is the foundational process that establishes whether a vendor is appropriate for handling sensitive data and meeting organizational security and privacy requirements.
Why the other options are wrong
- A. Forensic inquiry applies to investigating incidents after they occur, not to vendor selection.
- B. Data mapping identifies what data an organization holds and where it flows; while important, it's not the specific protocol that was neglected in vendor selection.
- C. Privacy breach prevention is an outcome goal rather than the specific process that should have been followed before vendor selection.
Question 81
SCENARIO Please use the following to answer the next question: As the Director of data protection for Consolidated Records Corporation, you are justifiably pleased with your accomplishments so far. Your hiring was precipitated by warnings from regulatory agencies following a series of relatively minor data breaches that could easily have been worse. However, you have not had a reportable incident for the three years that you have been with the company. In fact, you consider your program a model that others in the data storage industry may note in their own program development. You started the program at Consolidated from a jumbled mix of policies and procedures and worked toward coherence across departments and throughout operations. You were aided along the way by the program's sponsor, the vice president of operations, as well as by a Privacy Team that started from a clear understanding of the need for change. Initially, your work was greeted with little confidence or enthusiasm by the company's "old guard" among both the executive team and frontline personnel working with data and interfacing with clients. Through the use of metrics that showed the costs not only of the breaches that had occurred, but also projections of the costs that easily could occur given the current state of operations, you soon had the leaders and key decision-makers largely on your side. Many of the other employees were more resistant, but face-to-face meetings with each department and the development of a baseline privacy training program achieved sufficient "buy-in" to begin putting the proper procedures into place. Now, privacy protection is an accepted component of all current operations involving personal or protected data and must be part of the end product of any process of technological development. While your approach is not systematic, it is fairly effective. You are left contemplating: What must be done to maintain the program and develop it beyond just a data breach prevention program? How can you build on your success? What are the next action steps? How can the company’s privacy training program best be further developed?
Show answer and explanation
Correct answer: A. Through targeted curricula designed for specific departments.
The scenario indicates the baseline training program has achieved sufficient organizational buy-in, and the director now seeks to move beyond general breach prevention. The most effective advancement is developing targeted curricula designed for specific departments because different departments interact with data differently, finance, operations, customer service, and development have distinct privacy risks and responsibilities. Customized training increases relevance, engagement, and effectiveness by addressing the actual workflows and decision points employees encounter in their roles.
Why the other options are wrong
- B. E-learning adoption primarily addresses delivery logistics and instructor efficiency, not the substance or effectiveness of privacy training development.
- C. Off-the-shelf programs may serve as baselines but lack customization to the organization's specific operations, workflows, and risk profile.
- D. Reviewing recent data breaches addresses breach response analysis, not the proactive development of training program content and scope.
Question 82
Under the General Data Protection Regulation (GDPR), which situation would be LEAST likely to require a Data Protection Impact Assessment (DPIA)?
Show answer and explanation
Correct answer: D. An online magazine using a mailing list to send a generic daily digest to marketing emails
A Data Protection Impact Assessment is required for high-risk processing such as large-scale processing of sensitive data, systematic monitoring, or use of new technologies. An online magazine sending a generic daily digest to a mailing list of marketing email subscribers is routine, low-risk marketing communication with minimal data subject impact. In contrast, processing genetic and health data, mass surveillance camera systems, and employee internet monitoring all involve sensitive information or intrusive monitoring and require DPIA.
Why the other options are wrong
- A. Processing genetic and health data involves special categories of personal data and requires a DPIA.
- B. Large-scale systematic monitoring of driving behavior involves mass surveillance and requires a DPIA.
- C. Employee internet activity monitoring involves systematic monitoring and potential surveillance, requiring a DPIA.
Question 83
What is the main function of the Asia-Pacific Economic Cooperation Privacy Framework?
Show answer and explanation
Correct answer: A. Enabling regional data transfers.
The Asia-Pacific Economic Cooperation Privacy Framework's primary function is to facilitate and enable the safe transfer of personal information across the Asia-Pacific region while maintaining privacy protections. It establishes a common set of privacy principles that member economies agree to implement, creating a mechanism of trust that allows organizations to transfer data regionally without requiring individual adequacy decisions for each transfer.
Why the other options are wrong
- B. The framework does not specifically protect data from external parties; it focuses on enabling transfers within the region.
- C. While the framework establishes principles, it does not create legal requirements; member economies implement their own laws based on these principles.
- D. Marketing privacy technologies is not a function of the APEC Privacy Framework.
Question 84
SCENARIO Please use the following to answer the next question: It's just what you were afraid of. Without consulting you, the information technology director at your organization launched a new initiative to encourage employees to use personal devices for conducting business. The initiative made purchasing a new, high-specification laptop computer an attractive option, with discounted laptops paid for as a payroll deduction spread over a year of paychecks. The organization is also paying the sales taxes. It's a great deal, and after a month, more than half the organization's employees have signed on and acquired new laptops. Walking through the facility, you see them happily customizing and comparing notes on their new computers, and at the end of the day, most take their laptops with them, potentially carrying personal data to their homes or other unknown locations. It's enough to give you data-protection nightmares, and you've pointed out to the information technology Director and many others in the organization the potential hazards of this new practice, including the inevitability of eventual data loss or theft. Today you have in your office a representative of the organization's marketing department who shares with you, reluctantly, a story with potentially serious consequences. The night before, straight from work, with laptop in hand, he went to the Bull and Horn Pub to play billiards with his friends. A fine night of sport and socializing began, with the laptop "safely" tucked on a bench, beneath his jacket. Later that night, when it was time to depart, he retrieved the jacket, but the laptop was gone. It was not beneath the bench or on another bench nearby. The waitstaff had not seen it. His friends were not playing a joke on him. After a sleepless night, he confirmed it this morning, stopping by the pub to talk to the cleanup crew. They had not found it. The laptop was missing. Stolen, it seems. He looks at you, embarrassed and upset. You ask him if the laptop contains any personal data from clients, and, sadly, he nods his head, yes. He believes it contains files on about 100 clients, including names, addresses and governmental identification numbers. He sighs and places his head in his hands in despair. Which is the best way to ensure that data on personal equipment is protected?
Show answer and explanation
Correct answer: C. Encryption of the data.
Encryption of data is the most effective protection for personal data on mobile or personal equipment. Even if a device is stolen or lost, encrypted data becomes unreadable and unusable to unauthorized persons without the encryption key. This protects the data regardless of the device's physical location or custody. User training is important but people make mistakes under stress or distraction. Biometric security only protects device access and does not protect data if the device is stolen and the storage medium is accessed directly. Backups allow recovery of lost data but do not prevent unauthorized access to stolen equipment containing personal information.
Why the other options are wrong
- A. User training reduces risk through behavior change but cannot eliminate the risk of theft or loss of physical devices.
- B. Biometric security protects device access but does not encrypt data, so stolen devices can still expose data through direct storage access.
- D. Frequent backups enable data recovery but provide no protection against unauthorized access to stolen equipment containing unencrypted personal data.
Question 85
What does it mean to “rationalize” data protection requirements?
Show answer and explanation
Correct answer: B. Look for overlaps in laws and regulations from which a common solution can be developed
To rationalize data protection requirements means to identify common threads and overlapping mandates across different applicable laws and regulations, then develop unified solutions that satisfy multiple requirements simultaneously. Rather than building separate compliance systems for each regulation, rationalization recognizes where different laws have similar requirements and creates consolidated approaches that efficiently address multiple regulations at once, reducing redundancy and complexity.
Why the other options are wrong
- A. Evaluating costs and penalties prioritizes certain regulations but does not constitute rationalization, which focuses on identifying commonalities.
- C. Eliminating regulations from compliance requirements is neither possible nor the goal; rationalization maintains compliance while reducing implementation complexity.
- D. Addressing less stringent regulations contradicts the principle that all applicable regulations must be followed regardless of stringency level.
Question 86
SCENARIO Please use the following to answer the next question: Edufox has hosted an annual convention of users of its famous e-learning software platform, and over time, it has become a grand event. It fills one of the large downtown conference hotels and overflows into the others, with several thousand attendees enjoying three days of presentations, panel discussions and networking. The convention is the centerpiece of the company's product rollout schedule and a great training opportunity for current users. The sales force also encourages prospective clients to attend to get a better sense of the ways in which the system can be customized to meet diverse needs and understand that when they buy into this system, they are joining a community that feels like family. This year's conference is only three weeks away, and you have just heard news of a new initiative supporting it: a smartphone app for attendees. The app will support late registration, highlight the featured presentations and provide a mobile version of the conference program. It also links to a restaurant reservation system with the best cuisine in the areas featured. "It's going to be great," the developer, Deidre Hoffman, tells you, "if, that is, we actually get it working!" She laughs nervously but explains that because of the tight time frame she'd been given to build the app, she outsourced the job to a local firm. "It's just three young people," she says, "but they do great work." She describes some of the other apps they have built. When asked how they were selected for this job, Deidre shrugs. "They do good work, so I chose them." Deidre is a terrific employee with a strong track record. That's why she's been charged to deliver this rushed project. You're sure she has the best interests of the company at heart, and you don't doubt that she's under pressure to meet a deadline that cannot be pushed back. However, you have concerns about the app's handling of personal data and its security safeguards. Over lunch in the break room, you start to talk to her about it, but she quickly tries to reassure you, "I'm sure with your help we can fix any security issues if we have to, but I doubt there'll be any. These people build apps for a living, and they know what they're doing. You worry too much, but that's why you're so good at your job!" What safeguard can most efficiently ensure that privacy protection is a dimension of relationships with vendors?
Show answer and explanation
Correct answer: A. Include appropriate language about privacy protection in vendor contracts.
Including appropriate language about privacy protection in vendor contracts is the most efficient safeguard because it establishes privacy obligations as a binding legal requirement from the start of the vendor relationship. Contractual language creates enforceable expectations, holds vendors accountable, and establishes the framework within which all other privacy practices must operate. This single mechanism ensures privacy protection becomes a structural dimension of the vendor relationship rather than an afterthought.
Why the other options are wrong
- B. Privacy audits are helpful but are evaluative rather than preventive safeguards.
- C. While valuable, requiring privacy-trained personnel on vendor selection teams is resource-intensive and doesn't guarantee ongoing vendor compliance.
- D. Restricting vendors to trade association members limits vendor options and doesn't guarantee individual vendor compliance with privacy requirements.
Question 87
SCENARIO Please use the following to answer the next question: Your organization, the Chicago (U.S.)-based Society for Urban Greenspace, has used the same vendor to operate all aspects of an online store for several years. As a small nonprofit, the Society cannot afford the higher-priced options, but you have been relatively satisfied with this budget vendor, Shopping Cart Saver (SCS). Yes, there have been some issues. Twice, people who purchased items from the store have had their credit card information used fraudulently subsequent to transactions on your site, but in neither case did the investigation reveal with certainty that the Society’s store had been hacked. The thefts could have been employee-related. Just as disconcerting was an incident where the organization discovered that SCS had sold information it had collected from customers to third parties. However, as Jason Roland, your SCS account representative, points out, it took only a phone call from you to clarify expectations and the “misunderstanding” has not occurred again. As an information-technology program manager with the Society, the role of the privacy professional is only one of many you play. In all matters, however, you must consider the financial bottom line. While these problems with privacy protection have been significant, the additional revenues of sales of items such as shirts and coffee cups from the store have been significant. The Society’s operating budget is slim, and all sources of revenue are essential. Now a new challenge has arisen. Jason called to say that starting in two weeks, the customer data from the store would now be stored on a data cloud. “The good news,” he says, “is that we have found a low-cost provider in Finland, where the data would also be held. So, while there may be a small charge to pass through to you, it won’t be exorbitant, especially considering the advantages of a cloud.” You begin to research and discover that a number of the leading cloud service providers have signed a letter of intent to work together on shared conventions and technologies for privacy protection. You make a note to find out if Jason’s Finnish provider is signing on. What is the best way for your vendor to be clear about the Society’s breach notification expectations?
Show answer and explanation
Correct answer: A. Include notification provisions in the vendor contract
Including breach notification provisions directly in the vendor contract creates legally binding, written expectations that both parties can reference and enforce. This formal documentation ensures clarity, establishes timelines, notification methods, and consequences for non-compliance. Telephone check-ins are informal and undocumented, memoranda of understanding lack legal binding force compared to contracts, and emailing regulations does not establish the vendor's specific obligations to the organization.
Why the other options are wrong
- B. Regular phone calls are informal, undocumented, and easily forgotten or disputed.
- C. A memorandum of understanding is less formal and legally binding than a vendor contract.
- D. Sending regulations does not clarify the vendor's specific responsibilities or create enforceable obligations.
Question 88
In regards to the collection of personal data conducted by an organization, what must the data subject be allowed to do?
Show answer and explanation
Correct answer: D. Challenge the authenticity of the personal data and have it corrected if needed.
Data subjects have the right to challenge the authenticity of personal data held about them and to have inaccurate, incomplete, or outdated data corrected or deleted. This right to rectification is a fundamental data subject right recognized in privacy frameworks including GDPR and other privacy regulations. It ensures individuals can maintain accuracy and integrity of their personal information. Data subjects cannot typically evaluate third-party processor qualifications before transfer, the organization makes this determination. While notification of breaches is important, no absolute guarantee of timing can be given. Data subjects cannot unilaterally set retention time limits, the organization determines lawful retention periods based on legal requirements and business necessity.
Why the other options are wrong
- A. Data subjects do not have the right to pre-approve third-party processors; the organization is responsible for selecting qualified processors.
- B. Organizations must notify of breaches, but specific timing guarantees cannot be extended as a data subject right; notification timing varies by jurisdiction.
- C. Retention periods are determined by the organization based on legal requirements and necessity, not by individual data subjects setting time limits.
Question 89
Under the General Data Protection Regulation (GDPR), when would a data subject have the right to require the erasure of his or her data without undue delay?
Show answer and explanation
Correct answer: D. When the data is no longer necessary for its original purpose.
Under GDPR, data subjects have the right to erasure (the 'right to be forgotten') when personal data is no longer necessary in relation to the purposes for which it was originally collected or processed. This is one of the primary grounds for the erasure right, allowing individuals to have their data deleted when it serves no legitimate ongoing purpose.
Why the other options are wrong
- A. Being a public authority does not grant a data subject the right to erasure of personal data.
- B. Public interest is a basis for restricting erasure rights, not granting them.
- C. The method of processing (automated means) does not determine erasure rights under GDPR.
Question 90
What is least likely to be achieved by implementing a Data Lifecycle Management (DLM) program?
Show answer and explanation
Correct answer: C. Crafting policies which ensure minimal data is collected.
Data Lifecycle Management (DLM) focuses on managing data throughout its lifecycle, from creation through retention to deletion. DLM directly reduces storage costs by archiving and deleting old data, ensures data isn't kept longer than necessary through retention policies, and increases awareness of confidentiality by establishing governance. However, DLM operates on data that already exists; it does not determine what data should be collected in the first place. Crafting policies to minimize data collection is a principle of data minimization and privacy by design, which occurs upstream of DLM during the data collection phase.
Why the other options are wrong
- A. DLM reduces storage costs by managing data retention and archiving.
- B. DLM ensures data is kept only for the retention period specified in policies.
- D. DLM programs increase awareness of confidentiality through governance and oversight.
That was 90 of 361.
The full IAPP CIPM pack has all 361 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.
Not ready yet? Get the first 155 free as one PDF by email. Get the Half Pack →