CDPSE Data Lifecycle Management 2 — Questions and Answers
Question 1: An organization collects customer email addresses for order confirmations but later uses them for marketing newsletters. This violates which data lifecycle principle?
- Data accuracy
- Purpose limitation (Correct answer)
- Storage limitation
- Integrity and confidentiality
Correct answer: Purpose limitation
Purpose limitation requires that personal data collected for a specific purpose must not be used for incompatible secondary purposes without a new legal basis.
Question 2: Which technique renders personal data permanently unusable by removing all direct and indirect identifiers?
- Pseudonymization
- Tokenization
- Anonymization (Correct answer)
- Encryption
Correct answer: Anonymization
Anonymization irreversibly removes all identifying information so that re-identification is not reasonably possible, taking the data outside the scope of most privacy regulations.
Question 3: A company stores personal data on decommissioned server hard drives in a locked warehouse. What is the MAIN privacy risk?
- Data accuracy degradation over time
- Unauthorized physical access leading to data recovery (Correct answer)
- Increased regulatory audit frequency
- Loss of data availability for business use
Correct answer: Unauthorized physical access leading to data recovery
Retaining unwiped storage media creates a risk that data could be physically accessed and recovered using forensic tools.
Question 4: Under the CDPSE framework, who bears primary accountability for defining data retention policies?
- IT security team
- Data owner or business unit responsible for the data (Correct answer)
- External auditors
- Cloud service provider
Correct answer: Data owner or business unit responsible for the data
The data owner is accountable for determining how long data must be retained to meet business and regulatory requirements.
Question 5: What is the privacy risk of keeping personal data in test and development environments?
- Lower system performance
- Exposure of live personal data in less-controlled environments (Correct answer)
- Increased cloud storage costs
- Difficulty in running automated tests
Correct answer: Exposure of live personal data in less-controlled environments
Dev and test environments typically have weaker security controls than production, so using real personal data risks unauthorized exposure.
Question 6: Which activity BEST supports the principle of data minimization during system design?
- Encrypting all collected fields
- Collecting only the data elements strictly required for the defined purpose (Correct answer)
- Backing up data to multiple geographic regions
- Applying role-based access controls to all data
Correct answer: Collecting only the data elements strictly required for the defined purpose
Data minimization means not collecting personal data beyond what is necessary, reducing the privacy risk surface from the outset.
CDPSE Data Lifecycle Management 2
An organization collects customer email addresses for order confirmations but later uses them for marketing newsletters.
This violates which data lifecycle principle?