Privacy Documentation (Policies, Guidelines) CDPSE Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A privacy officer is reviewing the organization's privacy policy to ensure it is complete. The policy currently includes the scope, data handling rules, and enforcement mechanisms. However, the privacy officer notices that the policy does not clearly define who is responsible for implementing and overseeing the policy. What essential component is missing?

   • AA list of all data processing systems used by the organization
   • BRoles and responsibilities, which assign accountability for the policy's implementation and oversight
   • CA statement that the policy is reviewed annually
   • DA detailed description of the organization's data breach response procedures
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   In which scenario is a privacy guideline more appropriate than a policy?

   • AWhen establishing a mandatory requirement to obtain consent
   • BWhen providing recommended best practices for data classification
   • CWhen setting a rule that all employees must complete training
   • DWhen defining a legal obligation under GDPR
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   What is the primary purpose of privacy guidelines?

   • ATo translate policy requirements into actionable steps for employees
   • BTo serve as a legal contract with data subjects
   • CTo replace the privacy policy with more detailed rules
   • DTo provide a high-level overview of the organization's privacy strategy
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A privacy team has updated the organization's data sharing policy. The policy now requires that all data sharing agreements be reviewed by the legal department. The team must communicate this change to the sales team, which frequently shares customer data with partners. The sales team has historically resisted new processes. What is the most effective communication strategy?

   • AMake the policy change effective immediately without any communication to the sales team
   • BSend an email to the sales team with the updated policy and a link to the legal department's review request form
   • CHold a meeting with the sales team to explain the reasons for the change and provide a checklist for the new review process
   • DAnnounce the change in the company-wide newsletter without targeting the sales team specifically
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   An organization's privacy committee has decided to retire an old privacy guideline that is no longer aligned with the current data protection regulations. What is the most appropriate action for the committee to take?

   • AFormally archive the guideline, document the reason for its retirement, and communicate the change to relevant stakeholders
   • BKeep the guideline active but add a note that it is outdated
   • CDelete the guideline from all systems without any record or communication
   • DReplace the guideline with a new policy that has the same content
   Reveal Solution Discussion Select an answer first