Privacy Principles (Privacy by Design, Consent, Transparency) CDPSE Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   An online retailer experiences a data breach that exposes customer names and email addresses. The breach is unlikely to result in a high risk to individuals' rights and freedoms. The company's legal counsel is determining the notification obligations. What is the most appropriate action regarding breach notification?

   • ANotify the supervisory authority only, as the risk to individuals is low
   • BDocument the breach and its assessment, and notify the supervisory authority if required by law, but do not notify individuals because the risk is low
   • CNotify the supervisory authority and all affected customers immediately
   • DTake no action because the breach did not involve financial data
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Under transparency obligations, privacy notices must be provided in a manner that is:

   • AClear and accessible to the data subject
   • BAvailable only upon request
   • CWritten in legal jargon to ensure precision
   • DProvided in a single language regardless of the audience
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which of the following is a key characteristic of a well-designed consent mechanism?

   • AIt bundles all processing purposes into a single consent request.
   • BIt uses pre-ticked boxes to increase consent rates.
   • CIt allows users to withdraw consent as easily as they gave it.
   • DIt requires users to contact customer support to change their consent preferences.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A large e-commerce platform operates in multiple jurisdictions. It has a centralized consent management system that records user consent for marketing emails. A user who lives in a jurisdiction with strict consent requirements withdraws consent for marketing. However, the marketing team continues to send emails because the user's profile in the CRM system was not updated. The privacy team is investigating. What is the most likely root cause of this compliance failure?

   • AThe user did not complete the withdrawal process correctly
   • BThe CRM system was not integrated with the consent management system, so the withdrawal was not propagated to all systems that use the data
   • CThe consent management system did not record the withdrawal correctly
   • DThe marketing team is intentionally ignoring the withdrawal
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A retail company is deploying a new loyalty app. The default configuration collects purchase history, location data, and browsing behavior. The privacy team wants to change the default so that only purchase history is collected, with location and browsing requiring explicit opt-in. A developer argues that collecting more data by default improves the app's personalization features. Which principle should the privacy team cite as the primary justification for their proposed change?

   • ATransparency requires clear disclosure of all data collection practices
   • BConsent must be freely given and can be withdrawn at any time
   • CData minimization requires collecting the least amount of data necessary for the stated purpose
   • DPrivacy by Default requires that the most privacy-friendly settings are the standard configuration
   Reveal Solution Discussion Select an answer first