Data Use Limitation CDPSE Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   What oversight activity is most appropriate for a data controller to verify a third-party processor's compliance with use limitations?

   • ARequesting the processor to self-certify compliance annually.
   • BConducting periodic audits or reviews of the processor's processing activities.
   • CAssuming compliance because the processor is well-known.
   • DRelying on the processor's marketing materials.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Which control is most effective for enforcing data use limitations?

   • AEncryption of data at rest and in transit.
   • BRegular data backups to prevent data loss.
   • CRole-based access control (RBAC) that restricts data access to authorized personnel.
   • DNetwork firewalls to block external threats.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   A company collected customer email addresses to send order confirmations. It now wants to use those addresses to send a weekly newsletter. According to purpose specification, what is the key issue?

   • AThe company must first verify that the email addresses are still valid.
   • BThe company can proceed because email addresses are not sensitive personal data.
   • CThe new use is incompatible with the original purpose of sending order confirmations.
   • DThe newsletter is a legitimate business activity, so no issue exists.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   A company collected health data for occupational health assessments. It now wants to use the data for a research study on workplace ergonomics. What is the most appropriate action?

   • AObtain explicit consent from the employees for the research use.
   • BNotify the employees after the research is completed.
   • CAnonymize the data before using it for research.
   • DProceed with the research because it is for a beneficial purpose.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Which factor is most relevant when assessing whether a new use of personal data is compatible with the original purpose?

   • AThe data subject's likely expectations based on the context of collection.
   • BThe cost of implementing the new processing activity.
   • CThe number of data subjects affected by the new use.
   • DThe technical difficulty of separating the data for the new use.
   Reveal Solution Discussion Select an answer first