Privacy Documentation (Policies, Guidelines) CDPSE Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A privacy officer is managing the documentation lifecycle for the organization's privacy policies. The organization is about to enter a new market with significantly different data protection regulations. The privacy officer must update the policies to comply with the new regulations while minimizing disruption to existing operations. What is the most effective approach?

   • ARewrite all policies from scratch to ensure full compliance with the new regulations
   • BConduct a gap analysis between the current policies and the new regulations, then update only the sections that are non-compliant
   • CDelay updating the policies until the organization has fully entered the new market
   • DUpdate the policies based on the privacy officer's knowledge of the new regulations without consulting legal counsel
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A multinational organization is aligning its privacy policies with both the GDPR and a new local data protection law in a country where it operates. The local law has stricter requirements for data retention than the GDPR. The privacy team must update the policies to comply with both regulations. What is the most appropriate approach?

   • AAdopt the GDPR retention requirements globally to simplify compliance
   • BCreate separate policies for each region without considering the interaction between the regulations
   • CAdopt the stricter local retention requirements in the policies for that country while maintaining GDPR compliance for other regions
   • DAdopt the local law's retention requirements globally to ensure consistency
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A multinational company's privacy team has published a mandatory data retention policy. The team now needs to help regional marketing staff understand how to apply the retention schedule to their day-to-day campaign data. The privacy team wants to provide practical, actionable guidance without creating another formal compliance obligation. What should the privacy team create?

   • AAn updated data retention policy that includes examples of campaign data for each region
   • BA training video that only explains the legal basis for the retention schedule
   • CA new policy that restates the retention schedule with additional enforcement mechanisms
   • DA guideline document that translates the retention schedule into step-by-step instructions for marketing workflows
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A privacy officer is reviewing the organization's privacy documentation and finds that the data retention policy was last updated three years ago. Since then, the organization has adopted a new customer relationship management (CRM) system and entered a new market with stricter data protection regulations. What is the most appropriate first step for the privacy officer to take?

   • ADistribute the existing policy to all employees without any changes
   • BImmediately retire the policy and draft a completely new one from scratch
   • CArchive the policy and rely on the new CRM system's default privacy settings
   • DInitiate a scheduled review of the policy to assess its alignment with the new CRM system and regulatory requirements
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A privacy officer is defending the organization's privacy documentation program to the board. The board questions the value of maintaining extensive documentation, arguing that it is a cost without clear benefit. The organization operates in a jurisdiction with a new data protection law that requires demonstrable accountability. What is the strongest justification for the documentation program?

   • AThe documentation is required by the organization's internal policies, so it must be maintained
   • BThe documentation is a best practice that improves customer trust and brand reputation
   • CThe documentation provides evidence of compliance with the law, which is necessary to demonstrate accountability and avoid potential penalties
   • DThe documentation helps the organization avoid all data breaches
   Reveal Solution Discussion Select an answer first