CDPSE CDPSE 2 — Questions and Answers
Question 1: An organization wants to implement data minimization. Which approach BEST achieves this principle?
- Encrypt all personal data at rest
- Collect only the data strictly necessary for the specified purpose (Correct answer)
- Anonymize data after 90 days of storage
- Tokenize sensitive fields before processing
Correct answer: Collect only the data strictly necessary for the specified purpose
Data minimization means collecting only what is necessary for the defined purpose, reducing privacy risk at the source.
Question 2: Which technical control BEST enforces purpose limitation for personal data stored in a database?
- Role-based access control tied to processing purposes (Correct answer)
- Full-disk encryption on the database server
- Daily integrity checks on database tables
- Automated backup with 30-day retention
Correct answer: Role-based access control tied to processing purposes
RBAC tied to processing purposes ensures users and systems can only access personal data for authorized, defined purposes.
Question 3: A company processes health data under a research exemption. What privacy control is MOST critical to implement?
- Public disclosure of all research findings
- Pseudonymization of the health data before analysis (Correct answer)
- Deletion of data immediately after the study
- Sharing raw data with peer reviewers
Correct answer: Pseudonymization of the health data before analysis
Pseudonymization reduces re-identification risk while still enabling legitimate research under many privacy frameworks.
Question 4: Under GDPR, a Data Protection Officer (DPO) reports a data breach to the supervisory authority 80 hours after discovery. What is the consequence?
- No consequence if the breach was minor
- The notification is late since GDPR requires 72 hours (Correct answer)
- The organization receives automatic immunity
- The 80-hour window is acceptable if justified
Correct answer: The notification is late since GDPR requires 72 hours
GDPR Article 33 requires notification to the supervisory authority within 72 hours of becoming aware of a breach.
Question 5: Which Privacy Enhancing Technology (PET) allows computations on encrypted data without decrypting it?
- Differential privacy
- Homomorphic encryption (Correct answer)
- Data masking
- Tokenization
Correct answer: Homomorphic encryption
Homomorphic encryption enables mathematical operations on ciphertext, so sensitive data never needs to be decrypted for processing.
Question 6: A Privacy Impact Assessment (PIA) reveals high residual risk after controls are applied. What is the NEXT appropriate step?
- Proceed with processing and monitor quarterly
- Accept the risk and document the decision
- Consult with the supervisory authority before proceeding (Correct answer)
- Immediately halt all data processing activities
Correct answer: Consult with the supervisory authority before proceeding
Under GDPR, when residual risk remains high after mitigation, a Data Protection Impact Assessment (DPIA) consultation with the supervisory authority is required before processing.
Question 7: An organization transfers personal data from the EU to a country without an adequacy decision. Which mechanism is MOST commonly used?
- Binding Corporate Rules (BCRs)
- Standard Contractual Clauses (SCCs) (Correct answer)
- Privacy Shield certification
- Explicit consent from each data subject
Correct answer: Standard Contractual Clauses (SCCs)
Standard Contractual Clauses are the most widely used transfer mechanism for EU data exports to non-adequate third countries.
CDPSE CDPSE 2
An organization wants to implement data minimization.
Which approach BEST achieves this principle?