CDPSE Consent Management 1 — Questions and Answers
Question 1: What is the primary purpose of consent management in data privacy?
- To document and enforce user agreements for the collection and processing of personal data (Correct answer)
- To encrypt personal data before storing it in a database
- To define the retention period for all personal data assets
- To authenticate users before they access a privacy portal
Correct answer: To document and enforce user agreements for the collection and processing of personal data
Consent management ensures organizations obtain, record, and honor individuals' explicit agreement regarding how their personal data is collected and used.
Question 2: Under GDPR Article 7, which of the following conditions makes consent valid?
- Consent is bundled with terms and conditions so users accept it all at once
- Consent is freely given, specific, informed, and unambiguous (Correct answer)
- Consent is inferred from continued use of a service
- Consent is obtained once and applies to all future processing activities
Correct answer: Consent is freely given, specific, informed, and unambiguous
GDPR requires consent to be freely given, specific, informed, and unambiguous — meaning a clear affirmative action is required from the data subject.
Question 3: What is 'granular consent' in the context of privacy engineering?
- Consent obtained at very frequent time intervals to stay current
- A single consent covering all data processing purposes at once
- Separate consent obtained for each distinct processing purpose rather than a single blanket approval (Correct answer)
- Consent provided by a delegated data steward on behalf of users
Correct answer: Separate consent obtained for each distinct processing purpose rather than a single blanket approval
Granular consent allows individuals to agree to specific processing purposes independently, rather than accepting all uses through a single checkbox.
Question 4: What is the main function of a Consent Management Platform (CMP)?
- To detect and block unauthorized data access attempts in real time
- To automate the collection, storage, and enforcement of user consent preferences (Correct answer)
- To generate privacy impact assessments for new processing activities
- To manage data subject access requests and deletion workflows
Correct answer: To automate the collection, storage, and enforcement of user consent preferences
A CMP automates obtaining consent, maintains records of consent decisions, and enforces those preferences across systems and third-party integrations.
Question 5: How does opt-in consent differ from opt-out consent?
- Opt-in assumes the user agrees unless they take action to disagree; opt-out requires active agreement first
- Opt-in requires active affirmative action from the user; opt-out treats silence as agreement by default (Correct answer)
- Opt-in is used for sensitive data only; opt-out is used for all other personal data
- Opt-in is required by CCPA; opt-out is required by GDPR
Correct answer: Opt-in requires active affirmative action from the user; opt-out treats silence as agreement by default
Opt-in consent requires the user to actively agree before processing begins, while opt-out consent assumes agreement unless the user explicitly declines.
Question 6: What does 'freely given' consent mean under major privacy regulations such as GDPR?
- Consent must be provided at no financial cost to the data subject
- The data subject must have genuine choice and not face negative consequences for refusing consent (Correct answer)
- Organizations must provide free services in exchange for obtaining consent
- Consent can be assumed without requiring any explicit action from the user
Correct answer: The data subject must have genuine choice and not face negative consequences for refusing consent
Freely given consent means the data subject has a real choice; if refusal leads to denial of service or other detriment, the consent is not considered valid.
Question 7: When a user withdraws consent, how must an organization respond according to GDPR?
- The organization may continue processing data for up to 90 days to allow system updates
- Withdrawal only applies to future data collection and does not affect already-processed data
- The organization must cease processing and, where applicable, delete the data, making withdrawal as easy as giving consent (Correct answer)
- The organization can request re-consent before stopping any processing activity
Correct answer: The organization must cease processing and, where applicable, delete the data, making withdrawal as easy as giving consent
GDPR requires organizations to stop processing upon withdrawal of consent and ensure the withdrawal mechanism is as straightforward as the consent mechanism itself.
CDPSE Consent Management 1
What is the primary purpose of consent management in data privacy?