Evidence and Artifacts CDPSE Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A privacy analyst is reviewing evidence for a GDPR compliance audit. The evidence includes a privacy impact assessment (PIA) that was completed two years ago, a current data flow diagram, and recent breach notification logs. The analyst notices that the PIA does not mention a new marketing analytics tool that was deployed six months ago. What is the most appropriate conclusion and action?

   • AThe PIA is outdated; the analyst should update it to reflect the new tool and document the change as a new artifact
   • BThe analyst should report the missing PIA as a compliance failure to the regulator immediately
   • CThe PIA is still valid because it was approved by the DPO; no action is needed
   • DThe analyst should discard the old PIA and rely on the data flow diagram as the primary evidence
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   An organization has a privacy control that requires data minimization. Which artifact would be most appropriate to map to this requirement?

   • AA marketing brochure
   • BA server hardware inventory
   • CA list of all employees in the organization
   • DA data flow diagram showing data collection points
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   An organization is preparing for an audit against ISO 27701. The privacy team has collected a privacy policy, a record of processing activities (RoPA), and a set of data subject access request (DSAR) logs. What is the most effective way to demonstrate compliance with the requirement to respond to DSARs within the required timeframe?

   • AProvide the privacy policy as evidence that the organization has a process for responding to DSARs
   • BProvide the RoPA as evidence of the data processing activities
   • CExplain that the organization has never received a DSAR, so the requirement is not applicable
   • DMap the DSAR logs to the specific control that requires timely responses and show that the logs record the response times
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A privacy auditor is reviewing evidence of a company's compliance with data subject access request (DSAR) requirements. The company has a documented DSAR procedure, a log of DSAR responses, and a training record showing that staff completed DSAR training. Which evidence type is most direct proof that DSARs were handled correctly?

   • AThe log of DSAR responses
   • BAn interview with the privacy officer
   • CThe training record
   • DThe documented DSAR procedure
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A privacy team maintains a set of artifacts, including a data inventory and a vendor management policy. The team updates the data inventory quarterly, but the vendor management policy is updated only when a major change occurs. What is the best practice for managing these artifacts?

   • AUse version control for both artifacts and retain the previous versions for audit purposes
   • BDelete the previous version of the data inventory after each update to avoid confusion
   • CUpdate the vendor management policy quarterly to match the data inventory schedule
   • DStore all artifacts in a shared folder with no access restrictions
   Reveal Solution Discussion Select an answer first