Privacy Frameworks and Standards

Privacy Frameworks and Standards: A Complete CDPSE Guide to Why They Matter, What They Are, How They Work, and How to Answer Exam Questions

Introduction
Privacy frameworks and standards form the structural foundation of every privacy program. In the ISACA CDPSE (Certified Data Privacy Solutions Engineer) exam, they fall under privacy governance and risk management. The exam tests whether you can select, apply, map and operationalize these frameworks, not just whether you can recite their names. This guide explains why frameworks matter, what the major ones are, how they work in practice, and how to approach exam questions about them.

1. Why Privacy Frameworks and Standards Are Important
Consistency and structure: A framework gives the organization a repeatable, organized way to identify, assess and manage privacy risks across the entire data lifecycle, instead of reacting to each new law or incident in isolation.
Multi-jurisdictional compliance: Organizations often operate under several laws at once, such as GDPR, CCPA/CPRA, LGPD, PIPEDA and HIPAA. Frameworks provide a common control set that can be mapped to many legal requirements. This reduces duplicated effort and lets one control satisfy several obligations.
Risk-based decision-making: Frameworks such as the NIST Privacy Framework treat privacy as a risk to individuals and to the organization. This helps leaders prioritize resources and align privacy with enterprise risk management.
Accountability and demonstrable compliance: Regulators increasingly expect organizations to prove compliance, for example under the GDPR accountability principle. Recognized frameworks and certifiable standards such as ISO/IEC 27701 provide evidence of due diligence.
Common language: Frameworks give legal, IT, security, engineering and business teams shared terminology. This is essential for a privacy engineer who must turn legal requirements into technical controls.
Trust and market advantage: Certification or alignment with known standards reassures customers, partners and regulators. It also supports vendor and third-party assurance.

2. What Privacy Frameworks and Standards Are
A law or regulation is mandatory and enforceable, for example GDPR, CCPA or HIPAA.
A framework is a voluntary, flexible structure of principles, functions or practices that guides how a program is built, for example the NIST Privacy Framework or the OECD Guidelines.
A standard is a more prescriptive, formally published set of requirements. Organizations can often be audited or certified against it, for example ISO/IEC 27701.
A principle set is a high-level statement of privacy values that informs laws and frameworks, for example FIPPs or Privacy by Design.
Exam note: Questions often hinge on this distinction. Laws dictate WHAT you must do. Frameworks and standards guide HOW you do it.

Key Principle-Based Frameworks
Fair Information Practice Principles (FIPPs): These originated in the US in the 1970s and are the ancestor of most modern privacy laws. They cover notice, choice, access, integrity and security, and enforcement.

OECD Privacy Guidelines (1980, revised 2013): These set out eight principles:
1. Collection Limitation
2. Data Quality
3. Purpose Specification
4. Use Limitation
5. Security Safeguards
6. Openness
7. Individual Participation
8. Accountability
The 2013 revision added emphasis on privacy management programs, breach notification and risk-based approaches. These principles strongly influenced GDPR and many other laws.

APEC Privacy Framework: This is based on the OECD principles and adds Preventing Harm. It underpins the Cross-Border Privacy Rules (CBPR) system for data transfers among participating economies. A Global CBPR Forum now extends this approach beyond APEC.

Privacy by Design (Ann Cavoukian): This sets out seven foundational principles:
1. Proactive not Reactive; Preventative not Remedial
2. Privacy as the Default Setting
3. Privacy Embedded into Design
4. Full Functionality (Positive-Sum, not Zero-Sum)
5. End-to-End Security (Full Lifecycle Protection)
6. Visibility and Transparency
7. Respect for User Privacy (Keep it User-Centric)
GDPR Article 25 codifies this idea as data protection by design and by default. For CDPSE, this principle is central because the exam focuses on engineering privacy into systems.

Generally Accepted Privacy Principles (GAPP): These were developed by AICPA/CICA and set out ten principles:
1. Management
2. Notice
3. Choice and Consent
4. Collection
5. Use, Retention and Disposal
6. Access
7. Disclosure to Third Parties
8. Security for Privacy
9. Quality
10. Monitoring and Enforcement
GAPP has largely been superseded by the AICPA Privacy Management Framework and the SOC 2 Privacy criteria, but it still appears in privacy literature.

ISACA Privacy Principles (2017): These are highly relevant to the CDPSE exam. They set out 14 principles:
1. Choice and Consent
2. Legitimate Purpose Specification and Use Limitation
3. Personal Information and Sensitive Information Life Cycle
4. Accuracy and Quality
5. Openness, Transparency and Notice
6. Individual Participation
7. Accountability
8. Security Safeguards
9. Monitoring, Measuring and Reporting
10. Preventing Harm
11. Third Party / Vendor Management
12. Breach Management
13. Security and Privacy by Design
14. Free Flow of Information and Legitimate Restriction

Key Risk and Control Frameworks
NIST Privacy Framework (Version 1.0, 2020): This is a voluntary, risk-based tool modeled on the NIST Cybersecurity Framework. It has three parts:
- Core: five Functions. These are Identify-P, Govern-P, Control-P, Communicate-P and Protect-P. Each Function is broken into Categories and Subcategories.
- Profiles: A Current Profile shows where you are now. A Target Profile shows where you want to be. The difference between them is the gap to address.
- Implementation Tiers: Tier 1 Partial, Tier 2 Risk Informed, Tier 3 Repeatable and Tier 4 Adaptive. Tiers describe how mature the organization's privacy risk management practices are.
The framework frames privacy risk as problems individuals may experience from data processing, called problematic data actions. It shows that privacy and cybersecurity overlap, particularly where security incidents cause privacy harm, but are not identical. Privacy risk can arise even from authorized processing.

NIST SP 800-53 Rev. 5: This catalog integrates security and privacy controls. It includes the PT (PII Processing and Transparency) family and privacy-relevant controls across other families.
NIST SP 800-122: This publication covers protecting the confidentiality of PII, including PII confidentiality impact levels.

ISO/IEC 27701: This standard defines a Privacy Information Management System (PIMS). It was originally published as an extension to ISO/IEC 27001 and 27002. It contains separate control guidance for PII controllers and PII processors, and maps to GDPR. It is certifiable, which makes it valuable for demonstrating compliance.
ISO/IEC 29100: This standard provides a privacy framework with terminology, actors and 11 privacy principles. These include consent and choice, purpose legitimacy, collection limitation, data minimization, use and retention limitation, accuracy, openness, individual participation, accountability, information security and privacy compliance.
ISO/IEC 29134: This gives guidelines for Privacy Impact Assessments (PIAs).
ISO/IEC 29151: This is a code of practice for protecting PII.
ISO/IEC 27001/27002: This is the information security management foundation on which privacy controls are built.
ISO 31000: This provides general risk management guidelines that apply to privacy risk.
COBIT: This is ISACA's governance framework. It helps align privacy governance with enterprise IT governance.
Industry standards: PCI DSS covers payment card data, and the HITRUST CSF is common in healthcare. These are sector-specific but contain privacy-relevant controls.

3. How Privacy Frameworks Work in Practice
Step 1: Understand the context. Identify the applicable laws, contracts, industry requirements, business objectives, data types and risk appetite.
Step 2: Select a framework or combination. Choose based on the organization's needs. For example:
- Use NIST PF for flexible, risk-based program design.
- Use ISO/IEC 27701 when certification is needed.
- Use ISACA or OECD principles as a principle baseline.
Many organizations use a hybrid approach.
Step 3: Map requirements (control mapping or crosswalk). Build a unified control framework in which each control maps to several legal and framework requirements. For example, a single consent management control might satisfy GDPR, CCPA/CPRA and ISO 27701.
Step 4: Assess the current state (gap analysis). Compare existing practices against the framework. Use a NIST Current Profile versus Target Profile, or an ISO 27701 readiness assessment.
Step 5: Assess risk. Conduct PIAs and DPIAs, for example using ISO 29134. Identify problematic data actions and prioritize gaps by risk to individuals and the organization.
Step 6: Implement controls. These may be technical (encryption, pseudonymization, access control, data minimization in system design), administrative (policies, training, vendor contracts) or physical.
Step 7: Monitor, measure and improve. Use metrics, audits, internal reviews and maturity models. Follow the continuous improvement cycle (Plan-Do-Check-Act), which ISO management system standards build into their structure.
Step 8: Report and demonstrate accountability. Keep records of processing, audit evidence and certification. Report to senior management and the board.

Roles involved:
- The board and senior management set direction and risk appetite.
- The DPO or privacy officer oversees compliance.
- Privacy engineers (the CDPSE role) translate framework requirements into architecture, design and data lifecycle controls.
- Internal audit provides independent assurance.

4. How to Answer Exam Questions on Privacy Frameworks and Standards
CDPSE questions are usually scenario-based. They ask for the BEST, MOST, FIRST or PRIMARY action. They test judgment, not memorization alone.

Common question types:
- Selection: Which framework is MOST appropriate for a given goal? If the goal is certification or demonstrable compliance, choose ISO/IEC 27701. If the goal is a flexible, risk-based program aligned with an existing NIST CSF effort, choose the NIST Privacy Framework.
- Sequencing: What should be done FIRST when adopting a framework? The usual answer is to understand requirements, scope and context, or to perform a gap or current-state assessment, before implementing controls.
- Mapping: What is the BEST way to address multiple overlapping regulations? Create a unified control framework or crosswalk.
- Principle identification: A scenario describes collecting only the data necessary. Identify it as data minimization or collection limitation.
- Distinction: Separate laws from frameworks, controllers from processors, privacy from security, and PIAs from security risk assessments.

Exam Tips: Answering Questions on Privacy Frameworks and Standards
Tip 1: Know the purpose of each framework, not just its name. Ask yourself what problem it solves. ISO 27701 is certifiable. NIST PF is voluntary and risk-based. Privacy by Design is a design philosophy. OECD principles form the legal foundation.
Tip 2: Memorize key structures. These include the NIST PF Functions (Identify-P, Govern-P, Control-P, Communicate-P, Protect-P), Profiles and Tiers; the eight OECD principles; the seven Privacy by Design principles; and the 14 ISACA Privacy Principles.
Tip 3: Laws come first, frameworks support them. If a question pits legal requirements against framework guidance, compliance with applicable law takes precedence. A framework is a tool for meeting legal obligations.
Tip 4: Prefer the risk-based and business-aligned answer. ISACA favors answers that align privacy with business objectives and organizational risk appetite. Avoid answers that apply controls blindly or prioritize technology without governance.
Tip 5: Assessment before implementation. When asked what to do FIRST, look for options such as identifying applicable requirements, inventorying personal data, defining scope or conducting a gap analysis. Buying a tool or deploying a control is rarely first.
Tip 6: Watch for 'BEST' and 'MOST'. Several answers may be technically correct. Choose the one that is most comprehensive, most preventive or addresses the root cause. Privacy by Design favors proactive, embedded controls over remedial ones.
Tip 7: Distinguish privacy from security. Security protects data, covering confidentiality, integrity and availability. Privacy governs the appropriate use of personal data, covering purpose, consent, minimization and individual rights. Encryption alone does not ensure privacy compliance.
Tip 8: Recognize unified control frameworks. For multinational or multi-regulation scenarios, the best answer is usually to harmonize requirements into a single mapped control set, not to run a separate program for each law.
Tip 9: Senior management ownership. Framework adoption succeeds when it has executive sponsorship and defined accountability. Answers involving governance, policy and accountability often beat purely technical answers in governance questions.
Tip 10: Continuous improvement. Frameworks are not one-time projects. Choose answers that include ongoing monitoring, metrics, periodic reassessment and updates when laws, technology or business processes change.
Tip 11: Read scenarios for keywords. 'Certification' points to ISO 27701. 'Profiles' or 'Tiers' point to NIST PF. 'Cross-border transfers in Asia-Pacific' points to APEC CBPR. 'Embedded in design' or 'default settings' points to Privacy by Design. 'PIA methodology' points to ISO 29134.
Tip 12: Eliminate extreme answers. Options with words like 'always', 'never', 'only' or 'eliminate all risk' are usually wrong. Frameworks manage risk to an acceptable level. They do not eliminate it.

Sample Question Walkthrough
Question: A global company subject to GDPR, CCPA and LGPD wants to reduce duplicated compliance effort. What is the BEST approach?
A. Create separate compliance teams for each regulation
B. Adopt the strictest law and ignore the others
C. Develop a unified control framework mapped to all applicable requirements
D. Purchase a privacy management tool
Answer: C. A unified, mapped control framework addresses overlapping requirements efficiently while still capturing jurisdiction-specific differences. B is risky because the strictest law may not cover every unique requirement. D is a tool, not a strategy. A duplicates effort.

Summary
Privacy frameworks and standards translate abstract legal and ethical obligations into structured, measurable and auditable practices. For the CDPSE exam:
- Know the major frameworks (OECD, FIPPs, APEC, Privacy by Design, GAPP, ISACA Privacy Principles, NIST Privacy Framework, ISO/IEC 27701, 29100 and 29134).
- Understand when and why each is used.
- Remember the adoption lifecycle: context, selection, mapping, gap analysis, risk assessment, implementation, monitoring and reporting.
- Answer scenario questions by favoring risk-based, governance-driven, proactive and continuously improving approaches that put legal compliance and individual rights first.