Privacy Risk Management and Compliance

The privacy risk process, privacy impact assessments, training, threats and vulnerabilities and risk response, and compliance through frameworks, evidence and program metrics.

5 minutes 5 Questions

In the ISACA Certified Data Privacy Solutions Engineer (CDPSE) framework, Privacy Risk Management and Compliance sit within the Privacy Governance domain. Together they help an organization identify, evaluate and reduce threats to personal information while meeting legal, regulatory and contractual…

Concepts covered
Emerging Threats to PrivacyPrivacy Vulnerabilities in Systems and ProcessesActing on Privacy Assessment ResultsPrivacy Compliance Evidence and ArtifactsPrivacy Program Maturity AssessmentPrivacy Audits and Assurance ReviewsTriggers and Scoping for Privacy AssessmentsPrivacy Impact AssessmentsMapping Privacy Controls to FrameworksPrivacy Threat ModelingResidual Privacy Risk and Risk AcceptanceMeasuring Privacy Awareness EffectivenessPrivacy Risk Response OptionsPrivacy Program Metrics and ReportingPrivacy Risk Management ProcessPrivacy Frameworks and StandardsRole-Based Privacy TrainingPrivacy Risk Policies, Appetite, and Registers
Test mode:
Start practice test

CDPSE - Privacy Risk Management and Compliance Example Questions

Test your knowledge of Privacy Risk Management and Compliance

Question 1

A customer analytics platform went live last year after a completed privacy impact assessment (PIA). A development team now plans to feed precise location data from the enterprise's mobile app into the platform so marketing can build behavioral profiles. The team says the existing PIA already covers the platform. Which action should the privacy engineer take FIRST?

Correct Answer: Reassess the PIA, scoped to the new data category, purpose and dataflows

A PIA is a living document, and adding precise location data for a new behavioral profiling purpose materially changes the processing, so the existing assessment must be revisited for the new data category, purpose and dataflows before anything else.
A threshold analysis only decides whether a PIA is needed; here a PIA already exists and the change clearly triggers reassessment, so the scope should be the whole new processing, not just collection points. Updating the privacy notice is premature until risks and lawful basis are understood. A security risk assessment covers only confidentiality and integrity, not purpose, fairness or profiling risks.
Key concept: PIAs must be reassessed when processing changes materially.

Question 2

An enterprise is integrating privacy into its existing enterprise risk management process. A privacy engineer finds that the risk register rates each privacy risk only on breach likelihood and financial loss to the organization. Which change would BEST improve the accuracy of these privacy risk ratings?

Correct Answer: Add impact criteria for harm to data subjects from authorized processing

Privacy risk differs from security risk because it centers on harm to individuals, and that harm can arise even from authorized processing such as over-collection, surveillance, unexpected secondary use or discrimination. Adding impact criteria for data subject harm captures risks the current breach and financial loss model misses entirely.
Weighting breach likelihood by data sensitivity still measures only breach events and organizational exposure. Adding regulatory fine exposure is just another organization-centric financial measure. Mapping risks to existing security controls helps treat risk but does not make the ratings any more accurate, and it keeps the security-only lens.
Key concept: privacy risk models must assess harm to individuals from all processing, not just breach-driven organizational loss.

Question 3

A privacy engineer updates the privacy risk register after a privacy impact assessment of a new location-tracking feature. The residual risk rating exceeds the threshold set in the enterprise's privacy risk appetite statement. The product team still wants to launch on schedule. What should the privacy engineer do NEXT?

Correct Answer: Escalate the register entry to the designated risk owner for a documented treatment decision

When residual risk exceeds the enterprise's risk appetite, the privacy engineer lacks authority to decide its treatment. The register entry must be escalated to the designated risk owner, who makes and documents a decision to mitigate, transfer, avoid or formally accept the risk.
Recording the risk as accepted oversteps the engineer's authority and bypasses the appetite threshold. Lowering the likelihood score for controls that are only planned misrepresents the current residual risk. Adding a consent prompt and marking the entry mitigated is a unilateral fix that has not been validated and may not reduce the risk below the threshold.
Key concept: risk ownership and escalation when residual risk exceeds risk appetite.

More Privacy Risk Management and Compliance questions
483 questions (total)
Practice 100 questions
One session at a time, always new questions