Organizational Culture, Structure, and Responsibilities CDPSE Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   An organization is implementing a new human resources system that will process employee personal data. The privacy team needs to collaborate with the HR department to ensure compliance. Which action best facilitates this collaboration?

   • AThe privacy team provides a list of privacy requirements to HR and expects them to implement it without further support.
   • BThe privacy team unilaterally decides on the system's data processing features and informs HR.
   • CThe privacy team conducts a privacy impact assessment (PIA) in partnership with HR and IT, and provides training to HR staff on data handling.
   • DThe HR department implements the system without consulting the privacy team, relying on the vendor's compliance assurances.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   In a privacy governance structure, what is the primary purpose of a privacy steering committee?

   • ATo handle individual data subject access requests
   • BTo provide cross-functional oversight and direction for the privacy program
   • CTo approve every individual privacy impact assessment
   • DTo perform technical penetration testing on systems
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A company has a culture where employees are rewarded for taking risks and pushing boundaries. This has led to several privacy incidents. The privacy team wants to change the culture to be more privacy-conscious without stifling innovation. Which approach is most likely to succeed?

   • AHire a privacy officer who can personally oversee all projects to ensure privacy is considered.
   • BConduct a series of workshops to educate employees on the importance of privacy.
   • CWork with leadership to redefine what constitutes 'success' to include responsible risk-taking that considers privacy implications.
   • DImplement a strict policy that prohibits any risk-taking that could impact privacy.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   What is the primary purpose of a privacy awareness program?

   • ATo ensure that employees understand privacy policies and their role in protecting personal data
   • BTo replace the need for privacy policies
   • CTo train employees on how to hack into systems
   • DTo provide legal advice to employees
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A company is designing its privacy governance structure. They have a DPO, a privacy committee, and data stewards in each business unit. The company is facing a complex privacy issue that involves legal, IT, and business decisions. Which path is most appropriate for resolving this issue?

   • AThe privacy committee makes the final decision without consulting the DPO.
   • BThe DPO makes the decision independently, based on their expertise and knowledge of the issue.
   • CThe data stewards escalate the issue to the privacy committee, which reviews it with input from legal, IT, and business representatives, and the DPO makes the final decision.
   • DThe data stewards make the decision, as they are closest to the data.
   Reveal Solution Discussion Select an answer first