CDPSE - Certified Data Privacy Solutions Engineer Data Subject Rights Questions and Answers

Question 1

A data subject submits a request for data portability to an online retailer.
The user has a purchase history, a wish list, and has provided explicit consent for their data to be processed for marketing purposes.
Which of the following datasets is a privacy engineer required to provide in a structured, commonly used, and machine-readable format to fulfill this request?

Accepted Answer

The purchase history and wish list, as this is data provided by the user through their actions.

Answer

Only the data actively provided by the user, such as name and email address.

Answer

All personal data related to the user, including internally generated analytics and user scores.

Answer

A summary of the marketing communications sent to the user.

Question 2

A data privacy solutions engineer is tasked with implementing a system to handle the 'right to erasure' (right to be forgotten). Which of the following presents the MOST significant technical challenge when ensuring complete and permanent deletion of a data subject's information?

Accepted Answer

Ensuring the data is purged from all backup and archival systems.

Answer

Removing the data from the primary production database.

Answer

Deleting the data from marketing and communication systems.

Answer

Updating the user interface to reflect the data has been deleted.

Question 3

When designing a new application that will process personal data, a privacy engineer incorporates a feature that allows users to easily download their data in a CSV format and provides granular controls over marketing preferences from the initial setup. This approach is a direct application of which fundamental privacy principle?

Accepted Answer

Privacy by Design

Answer

Data Minimization

Answer

Purpose Limitation

Answer

Storage Limitation

Question 4

A user submits a Data Subject Access Request (DSAR) to a company. The privacy engineering team has automated the data retrieval process, which gathers data from multiple structured and unstructured sources. Before delivering the data to the user, what is the MOST critical final step the team must engineer into the process?

Accepted Answer

Redacting the personal data of other individuals from the collected records.

Answer

Verifying the user's identity to a reasonable degree of certainty.

Answer

Logging the request in an immutable audit trail.

Answer

Converting the retrieved data into a proprietary encrypted format.

Question 5

An organization receives a valid request for erasure from a former customer. However, the organization is legally required by financial regulations to retain transaction records for seven years. In this scenario, what is the appropriate technical and procedural response?

Accepted Answer

Erase the data that is not subject to the legal hold and inform the data subject about the data that must be retained, the legal basis for retention, and the retention period.

Answer

Immediately and completely erase all data related to the customer, including financial records.

Answer

Inform the data subject that the right to erasure does not apply and close the request.

Answer

Anonymize all financial records immediately so they are no longer personal data.

Question 6

Which of the following is a primary engineering goal when implementing the right to rectification under GDPR?

Accepted Answer

To propagate the correction to all systems and databases where the inaccurate data is stored.

Answer

To ensure the inaccurate data is archived securely before being corrected.

Answer

To notify the data subject within 48 hours that the correction has been made.

Answer

To log the IP address from which the rectification request was made.