Privacy-Focused Assessment (Privacy Impact Assessment) CDPSE Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   In a data flow map, what does an arrow from a system to an external vendor typically represent?

   • AThe deletion of personal data from the vendor's systems
   • BThe transfer or sharing of personal data with the vendor
   • CThe encryption of personal data before storage
   • DThe approval of data processing by the vendor
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which of the following changes would most likely trigger the need for a new or updated PIA?

   • AUpdating employee contact information in the internal directory
   • BMigrating customer data to a new cloud provider
   • CRenaming a department within the organization
   • DChanging the color scheme of the company website
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A healthcare startup is developing a mobile app that allows users to track their mental health symptoms and share the data with their therapists. The PIA identifies a high risk of re-identification if the data is shared with a research partner. The startup wants to proceed with the research partnership. Which mitigation strategy would be most appropriate to reduce the re-identification risk?

   • AObtain explicit consent from users for the research sharing.
   • BLimit the research sharing to aggregate data only.
   • CDe-identify the data by removing direct identifiers and applying a robust anonymization technique.
   • DShare the data only with researchers who sign a confidentiality agreement.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A retail company is conducting a PIA for a new loyalty program that will collect customer purchase history, email addresses, and location data from the mobile app. During the data flow mapping phase, the privacy team discovers that customer location data is transmitted to a third-party analytics vendor for targeted advertising, but this was not disclosed in the privacy policy. What is the most immediate action the privacy team should take?

   • AProceed with the PIA and document the data flow to the analytics vendor as a finding.
   • BRecommend halting the data sharing with the analytics vendor until the privacy policy is updated and consent is obtained.
   • CAsk the analytics vendor to sign a data processing agreement and continue the data flow.
   • DRemove location data from the loyalty program entirely to avoid the issue.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A software company is planning a minor update to its project management tool. The update will change the color scheme and add a new sorting feature for tasks. No new personal data will be collected, and the existing data processing remains the same. The company has an existing PIA for the tool. What is the most appropriate action regarding the PIA?

   • AIgnore the PIA because the update is too minor to matter.
   • BConduct a full new PIA because any change to a system requires a new assessment.
   • CUpdate the existing PIA to note the change and confirm that no new privacy risks are introduced.
   • DWait until the next scheduled review of the PIA to document the change.
   Reveal Solution Discussion Select an answer first