CDPSE By Design Principles 4

Question 1

Under GDPR Article 25, Privacy by Design is legally required. Which action best demonstrates compliance with this obligation during product development?

Accepted Answer

Documenting privacy controls considered and integrated during the design phase

Answer

GDPR Article 25 requires controllers to implement appropriate technical and organizational measures at the time of design, which must be documented as evidence of compliance.

Question 2

A company wants to analyze customer purchase trends without exposing individual customer data. Which Privacy by Design technique achieves both business and privacy goals (positive-sum)?

Accepted Answer

Using differential privacy to add statistical noise to aggregate outputs

Answer

Differential privacy allows meaningful statistical analysis while mathematically limiting the ability to infer any individual's data, achieving both functionality and privacy.

Question 3

Which Privacy by Design principle is most directly supported by publishing an organization's privacy architecture and data flow documentation to stakeholders?

Accepted Answer

Visibility and Transparency — Keep it Open

Answer

Visibility and Transparency requires that organizations openly communicate their privacy practices, architectures, and policies so stakeholders can verify claims.

Question 4

An organization uses a single system to process both highly sensitive health data and general marketing preferences. A privacy architect proposes separating these into distinct systems. This addresses which risk?

Accepted Answer

Aggregation risk and data contamination across contexts

Answer

Separating systems prevents aggregation risk, where combining disparate data types creates a more sensitive profile than any single dataset would represent.

Question 5

When implementing Privacy by Design in a microservices architecture, which approach best supports the 'Embedded into Design' principle?

Accepted Answer

Defining privacy contracts and data handling rules within each service's API specification

Answer

Defining privacy handling within each service's API specification makes privacy a first-class architectural concern rather than an external enforcement layer.

CDPSE - Certified Data Privacy Solutions Engineer Practice Test

CDPSE - Certified Data Privacy Solutions Engineer Practice Test

CDPSE By Design Principles 4