Acting on Privacy Assessment Results (CDPSE: Privacy Risk Management and Compliance)
Overview
A privacy assessment produces information about risk. It does not protect anyone until someone acts on it. Assessments include Privacy Impact Assessments (PIAs), Data Protection Impact Assessments (DPIAs), privacy audits, gap analyses, vendor assessments and compliance reviews. Acting on Privacy Assessment Results covers what happens after the assessment:
• analysing the findings
• prioritizing them by risk
• choosing risk treatments
• assigning ownership
• implementing remediation
• monitoring and verifying fixes
• reporting to stakeholders
• feeding lessons back into the privacy program
For the ISACA CDPSE exam, this topic sits within the Privacy Governance and Risk Management domain. It is heavily tied to the privacy-by-design and risk-based thinking ISACA expects from a privacy engineer.
Why It Is Important
• Assessments without action create liability. A documented risk that was known and ignored is worse legally and reputationally than an unknown one. Regulators such as EU and UK data protection authorities treat a documented but unremediated risk as evidence of negligence.
• Regulatory obligations. GDPR Article 35 requires DPIAs for high-risk processing. Article 36 requires prior consultation with the supervisory authority when residual risk stays high after mitigation. Accountability principles (Article 5(2)) require organizations to show they acted on known risks.
• Risk reduction for data subjects. Privacy risk is ultimately about harm to individuals: discrimination, financial loss, loss of autonomy and distress. Remediation reduces that harm.
• Efficient resource allocation. Prioritizing findings by risk means limited budget and engineering time goes to the most significant exposures.
• Continuous improvement. Findings reveal systemic weaknesses that should update policies, standards, training and architecture patterns.
• Stakeholder trust. Boards, customers and partners want evidence that the privacy program is effective, not just documented.
What It Is
Acting on assessment results is the structured process of converting findings into decisions and controls. Its key components are:
• Findings and observations: gaps between current practice and requirements (legal, contractual, policy, or privacy principles such as data minimization, purpose limitation and transparency).
• Risk evaluation: rating each finding by likelihood and impact on data subjects and the organization. This gives a risk level (e.g., high, medium, low).
• Risk treatment options:
- Mitigate/reduce: implement controls such as encryption, pseudonymization, access restriction, retention limits or consent mechanisms.
- Avoid: stop or redesign the processing activity.
- Transfer/share: contracts, insurance, or processors with appropriate guarantees. Accountability is never transferred.
- Accept: formally accept residual risk within risk appetite. This requires approval by an authorized risk owner and documentation.
• Remediation / Corrective Action Plan (CAP): lists actions, owners, resources, deadlines and success criteria.
• Risk register update: records findings, treatments, residual risk and status.
• Monitoring and validation: follow-up testing to confirm controls are implemented and effective.
• Reporting and communication: to senior management, the board, the DPO, process owners and, where required, regulators.
• Feedback loop: updating the privacy program, data inventory, policies, training and design standards.
How It Works: Step by Step
1. Validate and understand findings. Confirm accuracy with process and system owners. Find the root cause rather than just symptoms. For example, excessive retention may come from a missing retention schedule, not one misconfigured database.
2. Assess and prioritize risk. Use the organization's risk methodology. Consider:
• sensitivity of the data (special categories, children's data, financial and health data)
• volume of data subjects
• likelihood of harm
• regulatory exposure
• cost and feasibility of remediation
High-risk findings affecting data subjects come first.
3. Assign ownership. Each finding needs an accountable risk owner, usually the business or process owner, not the privacy team. The privacy function advises, facilitates and monitors. Business owners own the risk and the decision.
4. Select treatment. Choose mitigate, avoid, transfer or accept based on risk appetite and cost-benefit. Prefer technical and privacy-by-design controls embedded in systems over purely procedural ones where practical.
5. Develop the remediation plan. Define:
• specific actions
• timelines matched to severity
• required resources
• dependencies
• measurable completion criteria
• interim compensating controls if full remediation takes time
6. Obtain management approval. Senior management approves the plan and any risk acceptance. Acceptance of high residual risk must be escalated to the appropriate level.
7. Implement controls. Engineering, IT, legal and business teams execute. Changes go through change management. Data inventories and records of processing (RoPA) are updated.
8. Verify and monitor. Retest or audit to confirm effectiveness. Track progress with metrics such as:
• percentage of findings closed on time
• overdue high-risk items
• residual risk trends
9. Report. Give dashboards and status reports to governance bodies. Communicate with regulators where legally required, such as DPIA prior consultation.
10. Close the loop. Update policies, standards, training, vendor requirements and future assessment scopes. Schedule reassessment when processing changes significantly.
Key Concepts to Remember
• Residual risk: the risk remaining after controls. It must be within risk appetite or formally accepted.
• Risk appetite and tolerance: set by senior management or the board. They determine what can be accepted.
• Compensating controls: temporary or alternative controls when the primary control is not feasible.
• Root cause analysis: prevents recurrence. It is better than patching symptoms.
• Accountability cannot be outsourced: even when a processor performs remediation, the controller remains accountable.
• Documentation: decisions, rationale and approvals must be recorded to demonstrate accountability.
• DPIA outcome: if high risk cannot be mitigated, consult the supervisory authority before processing. Alternatively, do not proceed.
Common Pitfalls
• Treating the assessment report as the end product.
• Having the privacy team own remediation instead of business owners.
• Accepting risk informally without authorized sign-off.
• Fixing symptoms without addressing root causes.
• Failing to verify that remediation actually works.
• Not updating the data inventory or risk register.
• Launching high-risk processing before mitigation is complete.
Exam Tips: Answering Questions on Acting on Privacy Assessment Results
• Think risk-based first. If a question asks what to do FIRST after an assessment, the answer is usually to evaluate and prioritize findings based on risk. Jumping straight to implementing controls is usually wrong. Validating findings with stakeholders can also come before remediation.
• Business owns the risk. When asked who should accept risk or approve remediation, choose the process, data or business owner or senior management. The privacy officer, DPO or IT advises and monitors but does not usually accept business risk.
• Risk acceptance must be formal. Correct answers mention documented acceptance by an authorized person within risk appetite.
• Prefer root cause over symptoms. If one option addresses the underlying process or policy gap and another fixes one instance, choose the root-cause option.
• Verification matters. After remediation, the BEST next step is often to validate or test the effectiveness of controls, not just to close the ticket.
• Data subject impact is central. CDPSE emphasizes harm to individuals. When prioritizing, choose the option that best reduces harm to data subjects, especially for sensitive data.
• High residual risk in a DPIA: the answer is consulting the supervisory authority or not proceeding. Do not proceed and hope.
• Privacy by design preference. When choosing between controls, ISACA tends to favor preventive, technical controls built into system design over detective or manual ones.
• Compensating controls are the right answer when remediation cannot happen immediately but risk must be reduced now.
• Update records. Answers that include updating the risk register, data inventory or RoPA reflect good governance.
• Reporting to management: significant unresolved findings should be escalated to senior management or the governance committee.
• Watch qualifiers: FIRST, BEST, MOST important and PRIMARY. Several answers may be correct actions. Pick the one that comes earliest in the logical sequence or delivers the greatest risk reduction.
• Eliminate extreme answers. Options like 'immediately stop all processing' or 'ignore low risks entirely' are usually wrong unless the scenario clearly involves severe, unmitigable harm.
• Sequence to memorize: Validate, Prioritize, Assign owner, Select treatment, Plan, Approve, Implement, Verify, Report, Improve.
Sample Question
A DPIA identifies that a new analytics system retains customer location data indefinitely. What should the privacy engineer do FIRST?
A) Delete all historical location data
B) Assess the risk and agree on remediation with the system owner
C) Notify the supervisory authority
D) Accept the risk because analytics is a business need
Answer: B. Evaluating the risk and engaging the accountable owner to define treatment comes first.
• A may be part of the eventual remediation but is premature and may break legal retention obligations.
• C is required only if high residual risk remains after mitigation.
• D lacks formal evaluation and authorization.
Summary
Acting on privacy assessment results turns analysis into protection. Prioritize by risk, assign accountable owners, choose and document treatments, implement and verify controls, report to governance and feed lessons back into the program. On the exam, favor answers that are risk-based, owner-accountable, documented, root-cause focused and verified.
