CDPSE CDPSE 4 — Questions and Answers
Question 1: A CDPSE is asked to implement a records of processing activities (RoPA). Which element is REQUIRED under GDPR Article 30?
- Copies of all data subject consent forms
- Categories of personal data and recipients (Correct answer)
- Source code for all data processing systems
- Annual audit reports from supervisory authorities
Correct answer: Categories of personal data and recipients
GDPR Article 30 requires RoPA to document categories of data, purposes, recipients, retention periods, and security measures, among other elements.
Question 2: What is the PRIMARY purpose of data pseudonymization compared to anonymization?
- Pseudonymization permanently removes all identifying information
- Pseudonymization is reversible and still subject to data protection laws (Correct answer)
- Pseudonymization requires no additional security controls
- Pseudonymization qualifies data as fully anonymous under GDPR
Correct answer: Pseudonymization is reversible and still subject to data protection laws
Pseudonymized data can be re-identified with additional information and therefore remains personal data subject to privacy regulations, unlike truly anonymized data.
Question 3: Which technique adds statistical noise to query results to prevent inference of individual records in a dataset?
- Data masking
- Tokenization
- Differential privacy (Correct answer)
- Encryption
Correct answer: Differential privacy
Differential privacy adds calibrated noise to outputs so that the presence or absence of any individual's data cannot be determined from the results.
Question 4: Under CCPA, which right allows California consumers to obtain a copy of the personal information a business has collected about them?
- Right to deletion
- Right to opt-out of sale
- Right to know (Correct answer)
- Right to non-discrimination
Correct answer: Right to know
The CCPA Right to Know allows consumers to request disclosure of what personal information a business has collected, used, disclosed, or sold about them.
Question 5: A CDPSE is assessing a biometric authentication system. Which privacy risk is UNIQUE to biometric data compared to passwords?
- Biometric data is harder to encrypt than passwords
- Biometric identifiers cannot be changed if compromised (Correct answer)
- Biometric systems require more storage than password hashes
- Biometric data is excluded from privacy regulations
Correct answer: Biometric identifiers cannot be changed if compromised
Unlike passwords, biometric identifiers such as fingerprints or iris scans cannot be reset if exposed, making a breach permanently harmful to the individual.
Question 6: Which control BEST addresses the privacy risk of employees accessing more personal data than their role requires?
- Full-disk encryption on workstations
- Attribute-based access control with least privilege (Correct answer)
- Multi-factor authentication for all logins
- Data loss prevention scanning on email
Correct answer: Attribute-based access control with least privilege
Attribute-based access control with least privilege ensures employees can access only the personal data their specific role and purpose require.
Question 7: An organization receives a Data Subject Access Request (DSAR). Under GDPR, what is the standard response deadline?
- 30 days, extendable by 60 days
- One month, extendable by two months where complex (Correct answer)
- 15 business days, no extension permitted
- 72 hours for sensitive data requests
Correct answer: One month, extendable by two months where complex
GDPR Article 12 requires response to DSARs within one month, extendable by two additional months for complex or numerous requests.
CDPSE CDPSE 4
A CDPSE is asked to implement a records of processing activities (RoPA).
Which element is REQUIRED under GDPR Article 30?