Data Privacy Risks and Controls

1. Why Data Privacy Risks and Controls Matter

Data privacy has moved from a niche compliance topic to a board-level enterprise risk. Organisations today collect, process, store and share enormous volumes of personal information about customers, employees, patients, suppliers and citizens. When that information is mishandled, the consequences are severe and multi-dimensional:

• Regulatory and legal exposure – Laws such as the EU General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA/CPRA), Brazil's LGPD, HIPAA in US healthcare, and dozens of national privacy statutes impose fines that can reach a percentage of global turnover, along with mandatory breach notification, litigation and regulatory orders to stop processing.
• Reputational damage – Loss of customer trust after a breach or a privacy scandal often costs more than the fine itself and can take years to rebuild.
• Operational disruption – Investigations, remediation, system shutdowns and regulator-imposed restrictions interrupt business activities.
• Strategic risk – Inability to demonstrate privacy compliance can block market entry, cross-border data transfers, mergers and partnerships.
• Ethical and human impact – Privacy harms affect real individuals through identity theft, discrimination, financial loss and distress.

For the CRMA candidate, this topic sits within Evaluating Risk Management Processes. The examiner is not testing whether you can recite every article of GDPR. The examiner is testing whether you understand how privacy risk should be identified, assessed, treated, monitored and reported within an enterprise risk management (ERM) framework, and how an internal auditor or risk assurance professional evaluates the adequacy and effectiveness of that process.

2. What Data Privacy Is (and How It Differs From Security)

Personal data / personally identifiable information (PII) is any information relating to an identified or identifiable natural person: names, identification numbers, addresses, email addresses, IP addresses, location data, biometric data, financial details, health records, and online identifiers. Sensitive (special category) data – such as health, racial or ethnic origin, religious beliefs, political opinions, sexual orientation, genetic and biometric data, and criminal records – attracts heightened protection.

A critical distinction the exam frequently probes:

• Information security asks: Is the data protected from unauthorised access, alteration or destruction? It is about confidentiality, integrity and availability (CIA).
• Data privacy asks: Should we have this data at all, did we obtain it fairly, are we using it only for legitimate purposes, are we keeping it only as long as needed, and can the individual exercise their rights over it?

Security is a necessary but insufficient condition for privacy. A perfectly secured database that stores data collected without consent, used for undisclosed purposes and retained forever is a privacy failure. Exam questions often present a scenario where strong encryption and access controls exist and ask what privacy gap remains; the answer typically relates to purpose limitation, consent, data minimisation, retention, or individual rights.

Core privacy principles (drawn from the OECD Guidelines, GDPR, the AICPA/CICA Generally Accepted Privacy Principles (GAPP), ISO/IEC 27701 and the NIST Privacy Framework):

1. Lawfulness, fairness and transparency – a valid legal basis exists and individuals are told clearly what happens to their data (notice).
2. Purpose limitation – data is collected for specified, explicit purposes and not further processed incompatibly.
3. Data minimisation – only data that is adequate, relevant and necessary is collected.
4. Accuracy – data is kept accurate and up to date.
5. Storage limitation (retention) – data is kept no longer than necessary and securely disposed of.
6. Integrity and confidentiality (security) – appropriate technical and organisational measures protect the data.
7. Accountability – the organisation can demonstrate compliance through governance, documentation, records and evidence.
8. Individual rights / choice and consent – access, rectification, erasure, portability, objection, restriction, and the right not to be subject to solely automated decisions.
9. Onward transfer and third-party management – data shared with processors or across borders remains protected.

Key roles: the data controller determines the purposes and means of processing; the data processor processes on the controller's behalf; the data subject is the individual; the Data Protection Officer (DPO) or Chief Privacy Officer provides independent oversight and advice; data owners/stewards are accountable for specific data sets within the business.

3. Common Data Privacy Risks

When evaluating risk identification, the CRMA professional should expect a mature risk register to reflect risks such as:

• Over-collection – gathering data beyond what the stated purpose requires.
• Lack of lawful basis or invalid consent – consent that is bundled, pre-ticked, not freely given or not recorded.
• Purpose creep / secondary use – marketing, analytics or AI model training using data collected for service delivery.
• Shadow data and unknown data flows – spreadsheets, personal devices, unsanctioned cloud apps, unmanaged backups.
• Excessive or stale access – employees or vendors able to view personal data they do not need; leavers whose access is not removed.
• Inadequate retention and disposal – indefinite storage, no deletion schedule, insecure disposal of hardware or paper.
• Third-party and supply-chain risk – processors and sub-processors without contracts, due diligence or monitoring; cloud providers in jurisdictions without adequate protections.
• Cross-border transfer risk – moving data across borders without transfer mechanisms (adequacy decisions, standard contractual clauses, binding corporate rules).
• Data breach – external attack, insider misuse, misdirected emails, lost devices, misconfigured cloud storage.
• Failure to honour data subject rights – inability to locate, correct, export or delete an individual's data within statutory timeframes.
• Automated decision-making and AI bias – profiling without transparency, explainability or human review.
• Inaccurate data – leading to wrong decisions about individuals.
• Regulatory change – new laws rendering existing practices non-compliant.
• Employee monitoring – surveillance of staff beyond what is proportionate and disclosed.

4. How Privacy Risk Management Works

A sound privacy risk management process mirrors the generic ERM cycle (as in COSO ERM or ISO 31000) but with privacy-specific content. The CRMA candidate should be able to describe each stage and what good looks like.

Stage 1 – Governance and accountability
• Board and senior management set privacy risk appetite and tone at the top.
• A privacy policy framework, approved and communicated, defines expectations.
• A DPO/Privacy Officer with independence, resources and direct access to the board.
• Clear ownership of personal data by business functions (first line), with privacy, compliance and risk functions providing oversight (second line), and internal audit providing independent assurance (third line) – the IIA Three Lines Model.
• Privacy by design and by default embedded into project, product and procurement methodologies.

Stage 2 – Data discovery, inventory and mapping
• A record of processing activities (ROPA) documenting what personal data is held, why, where, who has access, who it is shared with, and how long it is kept.
• Data flow diagrams showing collection points, systems, transfers and disposal.
• Data classification labelling personal and sensitive data so controls can be proportionate.

Exam insight: You cannot assess or control what you have not identified. If a scenario describes an organisation with no data inventory, the most fundamental weakness is in risk identification, and the first recommendation is to complete a data inventory and mapping exercise.

Stage 3 – Risk assessment
• Privacy Impact Assessments (PIAs) and, where processing is high risk, Data Protection Impact Assessments (DPIAs) performed before new systems, products or processing activities begin.
• Assessing likelihood and impact on both the organisation and the individual (privacy frameworks uniquely emphasise harm to data subjects).
• Considering inherent risk, control effectiveness and residual risk against appetite.
• Prioritising high-risk processing: large-scale sensitive data, systematic monitoring, vulnerable individuals, new technologies.

Stage 4 – Risk treatment and controls
Controls can be classified by nature (administrative, technical, physical) and by timing (preventive, detective, corrective). A well-controlled environment combines them:

Administrative / organisational controls
• Privacy policies, standards and procedures.
• Privacy notices and consent management.
• Role-based training and awareness programmes.
• Data retention and disposal schedules.
• Vendor due diligence, data processing agreements, right-to-audit clauses.
• Data subject request handling procedures with tracking and deadlines.
• Incident and breach response plans with notification decision trees (e.g., 72-hour regulator notification under GDPR).
• Segregation of duties and least-privilege access provisioning.

Technical controls
• Encryption at rest and in transit; tokenisation; pseudonymisation and anonymisation.
• Identity and access management, multi-factor authentication, privileged access management.
• Data loss prevention (DLP), email filtering, endpoint protection.
• Logging, monitoring and user activity analytics (detective).
• Secure configuration, patching and vulnerability management.
• Automated data discovery and classification tools.
• Secure deletion and media sanitisation.
• Privacy-enhancing technologies and default privacy-protective settings.

Physical controls
• Secure facilities, badge access, clean-desk policies, locked storage, secure shredding.

Stage 5 – Monitoring, reporting and continuous improvement
• Key risk indicators (KRIs) and metrics: number of data subject requests and timeliness, training completion, number and severity of incidents, DPIAs completed vs. required, vendors assessed, access reviews completed, retention schedule compliance.
• Periodic control testing and self-assessments by the first and second lines.
• Regulatory horizon scanning.
• Reporting to the risk committee, audit committee and board.
• Lessons learned from incidents and near misses feeding back into risk assessment.

5. How the CRMA Professional Evaluates Privacy Risk Management

The exam expects you to think like an assurance provider, not a privacy officer. Your job is to evaluate whether the process is well designed and operating effectively, and whether management's view of residual risk is reliable. Key evaluation questions:

• Does the organisation know what personal data it holds and where (inventory and mapping)?
• Is privacy risk explicitly captured in the enterprise risk register with an accountable owner, and assessed consistently with other risks?
• Is there a defined risk appetite for privacy, and are residual risks compared against it?
• Are PIAs/DPIAs performed consistently and before, not after, go-live?
• Are controls mapped to identified risks, and is there evidence they operate (not just documented)?
• Is third-party processing governed by contracts, due diligence and ongoing monitoring?
• Are data subject rights requests and breach incidents handled within statutory timeframes, and are root causes addressed?
• Is privacy governance independent and adequately resourced? Does the DPO report at an appropriate level?
• Are KRIs meaningful, measured and acted upon?
• Is there a culture of privacy, evidenced by training completion, tone at the top and how incidents are escalated?

The auditor also considers maturity: is privacy risk management ad hoc, repeatable, defined, managed or optimised? Reporting should state both the maturity level and the gap to the target level approved by the board.

When internal audit advises on privacy programmes, independence must be protected: internal audit may consult and recommend but should not design, own or operate privacy controls it will later audit.

6. How to Answer Exam Questions on Data Privacy Risks and Controls

CRMA questions are predominantly scenario-based multiple choice. A structured approach:

Step 1 – Identify what the question is really asking. Is it about risk identification, assessment, treatment/controls, monitoring, or the auditor's role? The best answer must match that stage.

Step 2 – Spot the privacy principle at stake. Map the scenario facts to a principle: collecting birthdates to send a newsletter (minimisation), using customer data for a new analytics product (purpose limitation), retaining applicant CVs for ten years (storage limitation), a vendor in another country (transfer / third-party), a customer unable to get a copy of their data (individual rights).

Step 3 – Distinguish security from privacy. If the scenario already describes strong security and asks what remains, look for a non-security principle.

Step 4 – Think root cause and sequence. Examiners favour the most fundamental or earliest-stage answer. No data inventory beats weak encryption as the primary weakness, because the latter cannot be properly scoped without the former. Governance and accountability failures usually outrank individual control failures.

Step 5 – Apply the Three Lines Model. Management owns and operates controls; privacy/compliance/risk functions oversee and support; internal audit provides independent assurance. Any answer that has internal audit owning the privacy programme, approving consents or operating DLP tools is wrong.

Step 6 – Prefer process over product. When asked what gives the most assurance, choose an answer about a systematic, documented, evidenced and monitored process rather than a single tool or one-off action.

Step 7 – Eliminate absolutes and over-reach. Options containing words like all, never, eliminate, or guarantee are rarely correct in risk management; risk is managed to within appetite, not eradicated. Also eliminate options that are legally impossible or out of scope (e.g., the auditor contacting regulators directly on behalf of management).

Exam Tips: Answering Questions on Data Privacy Risks and Controls

• Tip 1 – Know the principles cold. Transparency, purpose limitation, minimisation, accuracy, retention, security, accountability, individual rights, third-party/transfer. Most questions hinge on one of them.
• Tip 2 – Inventory first. If an organisation lacks a data inventory or data map, that is almost always the most significant gap and the first recommendation.
• Tip 3 – PIAs/DPIAs are preventive and must be timely. A DPIA completed after implementation is a design weakness, not a control.
• Tip 4 – Consent must be freely given, specific, informed, unambiguous and withdrawable. Pre-ticked boxes, bundled consent and silence are not valid consent.
• Tip 5 – Controller vs. processor. The controller remains accountable even when a processor is at fault; outsourcing the activity does not outsource the risk.
• Tip 6 – Security is not privacy. Encryption answers rarely resolve purpose, consent or retention problems.
• Tip 7 – Breach response is about speed, documentation and notification. Look for defined roles, escalation, assessment of harm to individuals, regulator and data subject notification within required timeframes, and lessons learned.
• Tip 8 – Retention schedules are controls; indefinite retention is a risk. Keeping data just in case violates storage limitation and increases breach impact.
• Tip 9 – KRIs should be leading and actionable. Training completion, overdue data subject requests and unassessed vendors are better indicators than the number of policies written.
• Tip 10 – Preserve internal audit independence. Internal audit evaluates, advises and reports; it does not own privacy controls or make management decisions.
• Tip 11 – Think about harm to individuals, not just the organisation. Privacy frameworks uniquely require assessing impact on data subjects; answers that consider both dimensions are stronger.
• Tip 12 – Privacy by design. Embedding privacy requirements into project methodology, procurement and change management is a hallmark of mature programmes and a frequent best answer.
• Tip 13 – Read the stem for the superlative. Most, best, first, primary and least each change the correct answer. Rank the options rather than looking for one that is merely true.
• Tip 14 – Watch for shadow IT and manual workarounds. Spreadsheets emailed to personal accounts, unsanctioned cloud tools and departmental databases are classic examples of unidentified data flows.
• Tip 15 – Cross-border = transfer mechanism. Any scenario moving personal data between jurisdictions should trigger thoughts of adequacy, contractual clauses, binding corporate rules and local law conflicts.

7. Worked Example

Scenario: A retailer implemented strong encryption, multi-factor authentication and DLP on its customer database. During a review, the risk assurance team learns that the marketing department has begun using purchase histories to build predictive profiles sold to a partner, that no DPIA was performed, and that customer privacy notices still describe data use as limited to order fulfilment. Which weakness is most significant?

Analysis: Security controls are strong, so the issue is not security. The data is being used for a new purpose (purpose limitation), shared with a third party (onward transfer), without updated notice (transparency), and without assessing the risk (no DPIA). The most significant and root-cause weakness is the failure of the privacy risk assessment process – high-risk processing commenced without a DPIA and without privacy governance oversight, which allowed the purpose-limitation and transparency breaches to occur. A recommendation would be to suspend the sharing pending a DPIA, update notices and legal basis, execute a data processing/sharing agreement, and embed privacy-by-design gates into marketing initiatives.

8. Summary

Data privacy risk is an enterprise risk requiring the same disciplined lifecycle as any other: governance, identification (inventory and mapping), assessment (PIAs/DPIAs), treatment (layered administrative, technical and physical controls), and monitoring (KRIs, testing, reporting). The CRMA professional evaluates whether that lifecycle is designed appropriately, operating effectively and producing a reliable picture of residual risk relative to appetite. In the exam, anchor every answer to a privacy principle, distinguish privacy from security, favour root-cause and process-level answers, respect the Three Lines Model, and remember that accountability for personal data can be delegated in operation but never in responsibility.