Privacy Risk Response Options

Privacy Risk Response Options (CDPSE): Complete Guide and Exam Tips

Introduction
Privacy Risk Response Options are a core topic in the ISACA Certified Data Privacy Solutions Engineer (CDPSE) body of knowledge. They sit in the domain of Privacy Governance and Privacy Risk Management, often discussed alongside compliance. Once an organization has identified and assessed privacy risks, for example through a Privacy Impact Assessment (PIA) or a Data Protection Impact Assessment (DPIA), it must decide what to do about each risk. That decision is the risk response.

Why Privacy Risk Response Options Are Important
1. Protecting individuals (data subjects): Privacy risk is mainly about harm to people, such as identity theft, discrimination, loss of autonomy, embarrassment or financial loss. It is not only about harm to the organization. A good response reduces harm to data subjects.
2. Regulatory compliance: Laws such as the GDPR, CCPA/CPRA, HIPAA, LGPD and PIPEDA require organizations to apply appropriate technical and organizational measures. GDPR Article 32 refers to security appropriate to the risk. GDPR Article 36 requires prior consultation with the supervisory authority when a DPIA shows high residual risk that cannot be mitigated.
3. Efficient use of resources: Not every risk deserves the same investment. Response options let the organization prioritize based on risk appetite and tolerance.
4. Accountability and documentation: Regulators expect documented, justified decisions. A recorded risk response shows due diligence.
5. Supporting privacy by design: Choosing responses early in the system development life cycle is cheaper and more effective than retrofitting controls later.
6. Trust and reputation: Handling privacy risk properly maintains customer trust and brand value.

What Privacy Risk Response Options Are
A risk response is the action an organization chooses to bring a risk in line with its risk appetite. The four classic options, used by ISACA (COBIT, Risk IT) and by NIST and ISO 31000, are:

1. Risk Mitigation (Reduction / Treatment / Control)
This means implementing controls that reduce the likelihood and/or impact of a privacy risk. It is the most common response.
Privacy examples include:
- Data minimization: collect only what is necessary.
- Pseudonymization, anonymization, tokenization and encryption.
- Access controls and role-based access.
- Retention schedules and secure deletion.
- Consent management and privacy notices.
- Privacy-enhancing technologies (PETs) such as differential privacy and homomorphic encryption.
- Training, policies, audits and logging.
- Vendor due diligence and Data Processing Agreements (DPAs).

2. Risk Transfer (Sharing)
This shifts part of the financial or operational burden of a risk to a third party.
Examples include:
- Cyber or privacy liability insurance.
- Outsourcing processing to a vendor with contractual indemnification clauses.
Key point: accountability for privacy cannot be transferred. Under the GDPR, the controller remains responsible even when using a processor. Insurance covers financial loss but does not remove harm to data subjects or regulatory accountability.

3. Risk Avoidance (Termination)
This eliminates the risk by not doing the risky activity, or by stopping it.
Examples include:
- Deciding not to collect a category of sensitive data, such as biometrics.
- Cancelling a project whose privacy risks outweigh its benefits.
- Not transferring data to a jurisdiction lacking adequate protections.
- Discontinuing a legacy system that holds unnecessary personal data.
Avoidance is appropriate when risk is very high and no cost-effective controls exist, or when the processing is unlawful.

4. Risk Acceptance (Retention / Tolerance)
This means consciously deciding to take no further action because the risk is within appetite or the cost of treatment exceeds the benefit.
Requirements include:
- The decision must be formal, documented and approved by an appropriate risk owner, typically senior management or the business process owner. It is not made by the privacy engineer or IT alone.
- It must be monitored and periodically reviewed.
- Acceptance must never be used to tolerate non-compliance with the law. You cannot accept a risk of breaking a legal requirement as a business choice.

Related Concepts You Must Know
- Inherent risk: the risk before any controls are applied.
- Residual risk: the risk remaining after the response. It should be at or below risk appetite.
- Risk appetite: the amount of risk an organization is willing to pursue or accept. It is set by the board or senior management.
- Risk tolerance: the acceptable deviation from risk appetite.
- Risk owner: the person accountable for the risk and for the response decision, usually the business owner.
- Control owner: the person responsible for operating a control.
- Risk register: the document where risks, responses, owners and status are tracked.
- Cost-benefit analysis: a control should not cost more than the value it protects.
- Defense in depth: layered controls to reduce residual risk.

How Privacy Risk Response Works: The Process
1. Identify personal data flows and processing activities using a data inventory, data mapping and records of processing.
2. Assess the likelihood and impact of each risk, considering harm to individuals, using a PIA or DPIA.
3. Evaluate each risk against the organization's risk appetite and legal requirements.
4. Select a response: mitigate, transfer, avoid or accept. Often a combination is used, for example mitigating with encryption and transferring the residual risk with insurance.
5. Develop a risk action or treatment plan with owners, timelines, resources and success metrics.
6. Implement controls, applying privacy by design and by default.
7. Measure residual risk and confirm it is within appetite. If high residual risk remains under the GDPR, consult the supervisory authority.
8. Monitor and review continuously using KRIs (key risk indicators), audits and reassessment when systems, laws or threats change.
9. Report to senior management and the board, and document the decisions for accountability.

Choosing the Right Response: Decision Logic
- Is the processing unlawful or the risk unacceptably high with no feasible controls? Then avoid.
- Can cost-effective controls bring the risk within appetite? Then mitigate. This is usually the first choice.
- Is the remaining risk mainly financial and insurable or shareable contractually? Then transfer part of it.
- Is the residual risk low, within appetite, and is the cost of further treatment disproportionate? Then accept, with formal sign-off.

Worked Examples
Example 1: A marketing team wants to collect precise geolocation to send offers. The PIA shows high risk and the purpose can be met with city-level data. Best response: mitigate through data minimization by collecting coarse location only. If the business insists on precise data without a lawful basis, avoid that collection.

Example 2: A company moves HR data to a cloud provider. It signs a DPA, verifies the provider's SOC 2 report and ISO 27701 certification, encrypts the data, and buys cyber insurance. This is mitigation plus transfer. However, the company remains accountable as controller.

Example 3: After controls are applied, a low residual risk remains that a rarely used internal report could expose employee names. Fixing it costs far more than the potential impact. The HR director signs off. This is acceptance.

Example 4: A startup plans facial recognition in retail stores in a jurisdiction where it is effectively prohibited without explicit consent, which is impractical to obtain. This calls for avoidance.

Common Pitfalls
- Believing that outsourcing or insurance transfers legal accountability. It does not.
- Accepting risk informally or by default, through ignoring or doing nothing. That is not acceptance; it is negligence.
- Having IT or the privacy engineer accept risk instead of the business risk owner.
- Considering only organizational impact and ignoring harm to individuals.
- Choosing controls without cost-benefit analysis.
- Failing to reassess residual risk after implementing controls.

Exam Tips: Answering Questions on Privacy Risk Response Options
1. Know the four options cold: mitigate (reduce), transfer (share), avoid (terminate) and accept (retain). Learn the synonyms, since questions may use words such as treat, share or tolerate.
2. Accountability cannot be transferred. Any answer implying that a vendor contract or insurance removes the organization's responsibility is almost always wrong.
3. Risk acceptance is a management decision. If asked who should accept risk, pick the business or risk owner or senior management, not the privacy engineer, the DPO, IT or the auditor. The DPO advises but does not own business risk.
4. Legal non-compliance cannot simply be accepted. If an option says to accept a risk that violates the law, eliminate it.
5. Look for the 'BEST' or 'FIRST' keyword. ISACA questions often have several plausible answers. FIRST usually points to assessment or understanding the risk, such as conducting a PIA, before choosing a response. BEST usually points to the most effective or preventive option aligned with risk appetite.
6. Prefer preventive and design-level controls. Data minimization, privacy by design and avoiding unnecessary collection are typically favored over detective or corrective controls.
7. Data minimization often wins. If the question asks about reducing privacy risk and one option is to not collect or to delete unnecessary data, that is frequently the best answer.
8. Residual risk versus appetite. The goal of a response is to bring residual risk within risk appetite, not to eliminate all risk. Zero risk is rarely realistic, so be wary of answers promising it.
9. Cost-benefit matters. A control costing more than the asset or impact it protects is not appropriate. In that case, acceptance or transfer may be correct.
10. Think from the data subject's perspective. CDPSE emphasizes harm to individuals. When in doubt, choose the answer that protects personal data and individual rights.
11. Documentation is key. Answers involving documenting the decision, updating the risk register or obtaining formal sign-off are often correct for acceptance-related questions.
12. Scenario clues:
- 'Stop the project' or 'do not collect' signals avoidance.
- 'Insurance', 'indemnity' or 'outsource' signals transfer.
- 'Implement encryption, access control or pseudonymization' signals mitigation.
- 'Within appetite, approved by management, no further action' signals acceptance.
13. High residual risk under the GDPR: remember prior consultation with the supervisory authority (Article 36) before processing begins.
14. Combination responses are valid. Real-world and exam scenarios often use mitigation plus transfer, so do not assume options are mutually exclusive.
15. Monitoring never ends. Any response requires ongoing monitoring and periodic reassessment, especially after changes in technology, processing purposes or regulations.

Quick Recap
Privacy risk response is the step where assessed privacy risks are addressed through mitigation, transfer, avoidance or acceptance. Good responses are risk-based, cost-effective, aligned with risk appetite and legally compliant. They are owned by the business, documented and continuously monitored. In the exam, remember these points:
- Accountability stays with the organization.
- Acceptance requires formal management approval.
- Unlawful processing cannot be accepted.
- Preventive, privacy-by-design measures such as data minimization are usually the best answer.