CDPSE Impact Assessments 3

Question 1

When should a DPIA ideally be initiated in the system development lifecycle?

Accepted Answer

Before processing begins, during the design phase

Answer

A DPIA should be conducted early in the design phase so privacy risks can be addressed before systems are built, not retrofitted.

Question 2

A DPIA identifies a risk that cannot be mitigated using current technology. What should the organization document in the DPIA report?

Accepted Answer

The unmitigated risk, the reasoning for acceptance, and senior management sign-off

Answer

Accepted residual risks must be documented along with the justification and evidence of senior accountability for the decision.

Question 3

Under the NIST Privacy Framework, which function specifically covers the assessment of privacy risks to individuals?

Accepted Answer

Identify

Answer

The NIST Privacy Framework's 'Identify' function includes the 'Risk Assessment' category, where organizations assess privacy risks to individuals from data processing.

Question 4

A third-party vendor will process personal data on behalf of your organization. Who bears primary responsibility for ensuring a DPIA is completed?

Accepted Answer

The controller (your organization), as the entity determining the purpose of processing

Answer

Under GDPR, the controller determines the purpose and means of processing and therefore holds primary responsibility for conducting a DPIA.

Question 5

What is the role of 'likelihood' in calculating privacy risk during an impact assessment?

Accepted Answer

It estimates how probable it is that a threat will actually materialize and cause harm

Answer

Risk = Likelihood × Severity; likelihood estimates the probability that a given threat will exploit a vulnerability and result in harm to individuals.

CDPSE - Certified Data Privacy Solutions Engineer Practice Test

CDPSE - Certified Data Privacy Solutions Engineer Practice Test

CDPSE Impact Assessments 3