CDPSE - Certified Data Privacy Solutions Engineer Data Subject Rights Questions and Answers

Question 1

A data subject submits a request for data portability to an online retailer. The user has a purchase history, a wish list, and has provided explicit consent for their data to be processed for marketing purposes. Which of the following datasets is a privacy engineer required to provide in a structured, commonly used, and machine-readable format to fulfill this request?

Accepted Answer

The purchase history and wish list, as this is data provided by the user through their actions.

Answer

The right to data portability applies to personal data that a data subject has 'provided' to a controller. This includes not only data given explicitly (like a name) but also data generated by their activity, such as a purchase history or wish list. It does not typically apply to inferred or derived data, such as internal analytics. The response must be in a structured, commonly used, and machine-readable format like JSON or CSV.

Question 2

A data privacy solutions engineer is tasked with implementing a system to handle the 'right to erasure' (right to be forgotten). Which of the following presents the MOST significant technical challenge when ensuring complete and permanent deletion of a data subject's information?

Accepted Answer

Ensuring the data is purged from all backup and archival systems.

Answer

While deleting data from live production systems is a primary step, ensuring its complete removal from backup and archival systems presents the most significant technical challenge. Backups are often immutable or difficult to modify without compromising their integrity. A robust erasure process must have a technical solution to manage data in backups, such as overwriting it on a schedule or ensuring it's not restored, and this must be clearly communicated to the data subject. Modern enterprises often struggle with data that is duplicated across many systems, making true erasure a complex governance and architectural problem, not just a simple deletion task.

Question 3

When designing a new application that will process personal data, a privacy engineer incorporates a feature that allows users to easily download their data in a CSV format and provides granular controls over marketing preferences from the initial setup. This approach is a direct application of which fundamental privacy principle?

Accepted Answer

Privacy by Design

Answer

Privacy by Design (PbD) is the principle of proactively embedding privacy into the design and architecture of IT systems and business practices. By building features for data subject rights (like portability) and user control directly into the application from the start, the engineer is applying PbD, rather than treating privacy as an afterthought.

Question 4

A user submits a Data Subject Access Request (DSAR) to a company. The privacy engineering team has automated the data retrieval process, which gathers data from multiple structured and unstructured sources. Before delivering the data to the user, what is the MOST critical final step the team must engineer into the process?

Accepted Answer

Redacting the personal data of other individuals from the collected records.

Answer

While identity verification and logging are crucial initial and ongoing steps, the most critical final step before delivery is to review and redact any personal data belonging to other individuals. Disclosing third-party personal data would constitute a data breach. A robust DSAR process must include a systematic review and redaction phase to protect the privacy of others.

Question 5

An organization receives a valid request for erasure from a former customer. However, the organization is legally required by financial regulations to retain transaction records for seven years. In this scenario, what is the appropriate technical and procedural response?

Accepted Answer

Erase the data that is not subject to the legal hold and inform the data subject about the data that must be retained, the legal basis for retention, and the retention period.

Answer

The right to erasure is not absolute and is subject to exemptions, such as when data must be kept to comply with a legal obligation. The correct approach is to perform a partial deletion, erasing data that is no longer necessary while retaining the specific data required by law. The data subject must be informed about this, clarifying what data is being retained, why (the legal basis), and for how long.

CDPSE - Certified Data Privacy Solutions Engineer Practice Test

CDPSE - Certified Data Privacy Solutions Engineer Practice Test

CDPSE - Certified Data Privacy Solutions Engineer Data Subject Rights Questions and Answers