CDPSE Impact Assessments 4

Question 1

An organization transfers personal data to a country lacking an EU adequacy decision. How does this affect the DPIA process?

Accepted Answer

The transfer must be assessed as an additional risk factor within the DPIA

Answer

International transfers without adequacy decisions introduce additional legal and operational risks that must be identified and addressed as part of the DPIA's risk assessment.

Question 2

In an Algorithmic Impact Assessment (AIA), what is the primary focus beyond standard privacy risk?

Accepted Answer

Evaluating fairness, bias, and discriminatory outcomes for affected individuals

Answer

An AIA extends privacy impact analysis to include fairness, bias, and whether the algorithm produces discriminatory outcomes that could violate individuals' rights.

Question 3

Which privacy impact assessment approach requires organizations to consult with actual data subjects or their representatives?

Accepted Answer

A participatory PIA that includes stakeholder consultation

Answer

Participatory PIAs seek input from data subjects or their representatives to ensure real-world impacts on individuals are captured, not just theoretical risks.

Question 4

A health-tech startup processes de-identified patient data for research. Under what condition must a DPIA still be considered?

Accepted Answer

If re-identification risk remains non-trivial given available auxiliary data

Answer

If there is a realistic risk of re-identification using available data linkage techniques, the data may still qualify as personal data and a DPIA may be required.

Question 5

What distinguishes a 'screening' phase from a 'full DPIA' in a two-stage impact assessment methodology?

Accepted Answer

The screening phase determines whether the processing meets the threshold to require a full DPIA

Answer

A screening or threshold assessment evaluates whether the proposed processing is likely to result in high risk, which then triggers the obligation to conduct a full DPIA.

CDPSE - Certified Data Privacy Solutions Engineer Practice Test

CDPSE - Certified Data Privacy Solutions Engineer Practice Test

CDPSE Impact Assessments 4