Privacy Governance

Personal information, privacy principles, laws and documentation, and the privacy operations that run them: culture and roles, vendors, incidents and data subject rights.

5 minutes 5 Questions

In the ISACA Certified Data Privacy Solutions Engineer (CDPSE) framework, Privacy Governance is the first of three exam domains, alongside Privacy Architecture and Data Lifecycle. It covers the structures, policies, and accountability mechanisms an organization uses to handle personal data lawfully…

Concepts covered
Sensitive and Special Categories of Personal InformationData Subject RightsVendor Privacy Due DiligenceConsent and Lawful Bases for ProcessingVerifying and Fulfilling Data Subject RequestsCross-Jurisdictional and Sector-Specific RequirementsPrivacy Incident Response and RemediationPrivacy Requirements in Contracts and SLAsOngoing Monitoring of Third-Party Privacy PracticesPrivacy Program Structure and AccountabilityPrivacy Policies, Standards, and GuidelinesBreach Notification to Regulators and IndividualsTransparency and Privacy NoticesPersonal Information and IdentifiabilityPrivacy Roles and ResponsibilitiesApplicability of Privacy Laws and RegulationsBuilding a Privacy-Aware Organizational CultureRecords of Processing ActivitiesPrivacy by Design and by DefaultFair Information Practice and OECD Privacy Principles
Test mode:
Start practice test

CDPSE - Privacy Governance Example Questions

Test your knowledge of Privacy Governance

Question 1

What is the PRIMARY purpose of conducting a post-incident (lessons learned) review once a privacy breach has been contained and remediated?

Correct Answer: To identify root causes and improve controls and response procedures

A lessons learned review happens after containment and recovery. Its main goal is to find out why the breach occurred and how well the response worked, so the organization can strengthen controls, update its incident response plan, and prevent a repeat.
Deciding which data subjects to notify is done during the response, well before the post-incident phase. Restoring systems from clean backups belongs to recovery, which is already finished by the time this review begins. Assigning discipline goes against the blameless, improvement-focused nature of these reviews and discourages honest reporting.
Key concept: the post-incident phase of the incident response lifecycle and continuous improvement of privacy controls.

Question 2

Which approach BEST describes how an organization should verify a requester's identity before fulfilling a data subject access request?

Correct Answer: Proportionate checks that rely on information the organization already holds

Identity verification for access requests should be proportionate to the sensitivity of the data and the risk of wrongful disclosure, using information the organization already holds wherever possible. This confirms the requester is genuine without creating new privacy risks or unnecessary barriers.
Requiring government-issued identification for every request is excessive for low-risk requests and collects unneeded sensitive data. Gathering new identifiers to improve matching violates data minimization and expands the organization's data footprint. Authenticating once and reusing that result for later requests ignores changing circumstances such as account takeover or a different data scope.
Key concept: proportionate, data-minimizing identity verification for data subject rights requests.

Question 3

An enterprise's record of processing activities is compiled centrally by the privacy office. Periodic reviews keep finding entries whose stated purposes and recipients no longer match how business units actually use the personal information. Which assignment of responsibility would BEST keep the entries accurate over time?

Correct Answer: Business process data owners attest to their own entries on a set cycle

Business process data owners decide why personal information is used and who receives it, so making them attest to their own entries on a regular cycle places accountability with the people who actually know when purposes and recipients change.
Data custodians run the hosting systems but do not decide business purposes or recipients. Sign-off by the data protection officer after an annual interview round keeps the review central and infrequent, so gaps between reviews remain. Automated discovery scans can find where data is stored, but they cannot reliably show purpose or sharing intent, and the central office still lacks business context.
Key concept: data ownership and accountability for maintaining the record of processing activities.

More Privacy Governance questions
537 questions (total)
Practice 100 questions
One session at a time, always new questions