Privacy-Focused Assessment (Privacy Impact Assessment) CDPSE Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A university is conducting a PIA for a new research platform that will aggregate student records, including grades and disciplinary actions, with external survey data. The privacy office has drafted the initial risk assessment, but the IT department has not yet been consulted on the data flow. The legal department has also not reviewed the data sharing agreement with the external survey provider. What is the most appropriate next step?

   • AProceed with the project and document the missing stakeholder input as a residual risk.
   • BAsk the external survey provider to complete the PIA on behalf of the university.
   • CFinalize the PIA based on the privacy office's draft and submit it for approval.
   • DConvene a working group with IT and legal to validate the data flow and review the sharing agreement before finalizing the PIA.
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A privacy officer is leading a PIA for a new customer service chatbot that will process chat logs, purchase history, and customer feedback. The project is on a tight deadline, and the business unit wants to launch the chatbot in two weeks. The privacy officer has completed the data flow mapping and risk identification. The legal department has not yet reviewed the PIA, and the IT security team has not confirmed the encryption standards. What is the most appropriate action to balance the deadline with the need for a thorough PIA?

   • AAsk the business unit to sign a risk acceptance form for the missing reviews and launch on time.
   • BExpedite the legal and IT security reviews by having the privacy officer complete them on their behalf.
   • CLaunch the chatbot on time and complete the PIA after launch, as the risks are already identified.
   • DDelay the launch until the legal and IT security reviews are complete, even if it means missing the deadline.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A mid-sized manufacturing company is considering implementing a new employee monitoring system that tracks keystrokes and screenshots on company laptops. The HR director believes a PIA is unnecessary because the company owns the laptops and employees have signed an acceptable use policy. The privacy officer disagrees. What is the strongest argument the privacy officer can make for why a PIA is needed?

   • AThe monitoring involves systematic and intrusive processing of employee personal data, which is a high-risk activity.
   • BThe PIA is required by the acceptable use policy, so the company must follow its own rules.
   • CThe PIA is required because the company is a manufacturer, which is a regulated industry.
   • DThe PIA will help the company choose the best monitoring software vendor.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   What is the purpose of data flow mapping in a PIA?

   • ATo assign data ownership to business units
   • BTo encrypt all personal data in transit
   • CTo delete all unnecessary personal data
   • DTo identify where personal data is collected, used, stored, and shared
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A multinational corporation is conducting a PIA for a new global HR system that will consolidate employee data from multiple countries. The project manager wants to speed up the process by having the privacy team conduct the PIA independently. Which stakeholder should be included to ensure the PIA accurately reflects the data flows?

   • AThe facilities management team, to assess the physical security of the data centers.
   • BThe marketing department, to ensure the system aligns with the company's branding.
   • CThe external auditors, to verify the financial accuracy of the project.
   • DThe IT department, to confirm the technical architecture and data storage locations.
   Reveal Solution Discussion Select an answer first