Privacy-Focused Assessment (Privacy Impact Assessment) CDPSE Practice Questions (Page 7)

Questions 31–34

1. 31application · medium

   A telecommunications company completed a PIA for its customer account management system two years ago. Since then, the company has migrated the system to a new cloud provider and introduced a new feature that uses customer location data for network optimization. The original PIA did not cover these changes. What should the privacy team do?

   • AArchive the old PIA and document the changes in a simple change log without a formal review.
   • BUpdate the existing PIA to reflect the new cloud provider and the new location data processing.
   • CRely on the cloud provider's own PIA to cover the new processing.
   • DConduct a new, full PIA from scratch because the system has fundamentally changed.
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   Why is it important to periodically review and update a PIA?

   • ATo satisfy the requirement for annual employee training
   • BTo comply with hardware refresh cycles
   • CTo refresh the organization's branding and marketing materials
   • DTo ensure it reflects current processing activities and regulations
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   Which of the following is a privacy risk mitigation strategy?

   • AData aggregation
   • BData duplication
   • CData minimization
   • DData retention
   Reveal Solution Discussion Select an answer first
5. 34expert · hard

   A multinational retailer is conducting a PIA for a new global loyalty program. The data flow mapping reveals that customer data (name, email, purchase history) is collected in each country's local store and then transmitted to a central data warehouse in the United States for analysis. The privacy team is concerned about cross-border data transfers. The legal team has confirmed that the company has Standard Contractual Clauses (SCCs) in place for the transfers. What is the most appropriate next step in the PIA?

   • ARecommend that the loyalty program be canceled because cross-border transfers are too risky.
   • BDocument the SCCs as a mitigation for the cross-border transfer risk and proceed with the PIA.
   • CStop the PIA until the legal team can provide a more detailed analysis of the transfer risks.
   • DRecommend that the data be stored locally in each country to avoid cross-border transfers.
   Reveal Solution Discussion Select an answer first