CDPSE CDPSE 5 — Questions and Answers
Question 1: A company uses an AI model trained on customer data to make credit decisions. Which privacy principle is MOST relevant to ensure fairness and transparency?
- Storage limitation
- Right to explanation for automated decisions (Correct answer)
- Data portability
- Purpose limitation
Correct answer: Right to explanation for automated decisions
GDPR Article 22 grants individuals the right not to be subject to solely automated decisions and entitles them to an explanation of the logic involved.
Question 2: Which privacy architecture pattern separates the identity of a data subject from their transactional records using a mapping table stored separately?
- Data masking
- Encryption at rest
- Pseudonymization with a key vault (Correct answer)
- Differential privacy
Correct answer: Pseudonymization with a key vault
Pseudonymization with a separate key vault replaces direct identifiers with pseudonyms and stores the mapping securely, allowing re-identification only under controlled conditions.
Question 3: A multinational organization wants a single privacy framework to apply globally. Which standard BEST extends ISO 27001 with privacy-specific controls?
- NIST CSF
- ISO/IEC 27701 (Correct answer)
- SOC 2 Type II
- PCI DSS
Correct answer: ISO/IEC 27701
ISO/IEC 27701 extends ISO 27001 and ISO 27002 with privacy-specific requirements for PII controllers and processors, providing a global privacy management framework.
Question 4: What is the PRIMARY difference between a Data Controller and a Data Processor under GDPR?
- Controllers encrypt data; processors store data
- Controllers determine purposes and means; processors act on controller instructions (Correct answer)
- Controllers are public entities; processors are private companies
- Controllers handle EU data; processors handle non-EU data
Correct answer: Controllers determine purposes and means; processors act on controller instructions
A controller decides why and how personal data is processed; a processor handles data only on the controller's documented instructions.
Question 5: During a DPIA, which factor MOST increases the likelihood that prior consultation with a supervisory authority is required?
- Processing is conducted by a small business
- Processing involves systematic profiling of public spaces (Correct answer)
- Data is stored on premises rather than in the cloud
- Consent is obtained before each processing activity
Correct answer: Processing involves systematic profiling of public spaces
Systematic monitoring of public areas is listed in GDPR Article 35 as a high-risk processing type triggering mandatory DPIA and potential supervisory authority consultation.
Question 6: A breach exposes hashed passwords with bcrypt. The organization concludes notification to data subjects is NOT required. What is the BEST justification?
- Passwords are not considered personal data
- Bcrypt hashing makes it unlikely that individuals face high risk (Correct answer)
- Hash breaches are excluded from breach notification laws
- Less than 1,000 records were affected
Correct answer: Bcrypt hashing makes it unlikely that individuals face high risk
If the compromised data is rendered unintelligible (e.g., via strong hashing), GDPR allows controllers to conclude the breach is unlikely to result in high risk, waiving individual notification.
Question 7: Which privacy governance role is PRIMARILY responsible for ensuring data processing activities comply with applicable privacy laws on a day-to-day basis?
- Chief Information Security Officer (CISO)
- Data Protection Officer (DPO) (Correct answer)
- Chief Privacy Officer (CPO)
- Privacy Counsel
Correct answer: Data Protection Officer (DPO)
The DPO is the formal role under GDPR with specific independence and advisory responsibilities for monitoring compliance with data protection obligations.
CDPSE CDPSE 5
A company uses an AI model trained on customer data to make credit decisions.
Which privacy principle is MOST relevant to ensure fairness and transparency?