Data Minimization CDPSE Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   What is the primary purpose of a data retention policy?

   • ATo maximize the value of data by storing it for as long as possible
   • BTo transfer data to archival storage as soon as it is no longer actively used
   • CTo ensure data is kept indefinitely for potential legal disputes
   • DTo define how long data should be kept and when it should be securely disposed of
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A telecommunications company is subject to a regulatory requirement to retain call detail records (CDRs) for 12 months for billing disputes. The company currently retains CDRs for 5 years to support fraud investigations. The privacy team has been asked to reduce data retention to comply with data minimization. However, the legal department is concerned that deleting CDRs after 12 months could hinder ongoing fraud investigations that sometimes require data older than 12 months. Which approach best balances the regulatory requirement, data minimization, and the need for fraud investigations?

   • ARetain CDRs for 12 months for all customers, and implement a process to preserve specific CDRs beyond 12 months only when a formal fraud investigation is opened and documented.
   • BContinue retaining CDRs for 5 years because fraud investigations are a legitimate business purpose.
   • CDelete all CDRs after 12 months and rely on real-time monitoring for fraud detection.
   • DRetain CDRs for 5 years but pseudonymize them after 12 months.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   What is the purpose of monitoring data minimization practices?

   • ATo replace the need for data retention policies
   • BTo justify the need for collecting more data to stakeholders
   • CTo increase the amount of data collected to improve analytics
   • DTo ensure ongoing compliance with minimization policies and identify areas for improvement
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A multinational corporation is merging with another company. The privacy team needs to integrate the two companies' data inventories to identify redundancies and apply data minimization. The two companies use different data classification systems and have overlapping customer databases. Which approach should the privacy team take to effectively consolidate the inventories?

   • AMerge the inventories by copying all data into a single database and then deleting any records that are not used within 30 days.
   • BMap both inventories to a common data classification framework, identify overlapping data elements, and flag them for review and potential deletion.
   • CDelete all data from the acquired company's systems and rely on the acquiring company's data.
   • DKeep the two inventories separate and apply minimization to each independently.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which regulatory framework explicitly includes the principle of 'data minimisation' as a core requirement for processing personal data?

   • AHealth Insurance Portability and Accountability Act (HIPAA)
   • BGeneral Data Protection Regulation (GDPR)
   • CSarbanes-Oxley Act (SOX)
   • DPayment Card Industry Data Security Standard (PCI DSS)
   Reveal Solution Discussion Select an answer first