Evidence and Artifacts CDPSE Practice Questions (Page 8)

Questions 36–37

1. 36application · medium

   A privacy team is building a compliance evidence repository. They have a data retention policy, a set of access logs, and a completed data protection impact assessment (DPIA). Which of these items is best classified as an artifact rather than raw evidence?

   • AThe data retention policy
   • BBoth the policy and the DPIA are artifacts
   • CThe access logs
   • DThe DPIA
   Reveal Solution Discussion Select an answer first
2. 37expert · hard

   A privacy team must collect evidence of data subject access request (DSAR) handling for a regulatory audit. The DSAR process is manual, and the team has email threads, spreadsheets, and some paper forms. The audit requires evidence that requests were acknowledged within 48 hours. What is the most reliable collection method?

   • AUse an automated tool to extract timestamps from email threads and spreadsheets
   • BAsk the regulator to accept a verbal assurance that the team meets the 48-hour requirement
   • CManually compile a summary of response times based on the team's memory
   • DConduct interviews with the privacy team members who handle DSARs
   Reveal Solution Discussion Select an answer first