CDPSE Impact Assessments 5

Question 1

Which of the following BEST describes the concept of 'residual risk' in the context of a DPIA?

Accepted Answer

Risk that remains after all identified mitigation measures have been applied

Answer

Residual risk is the level of privacy risk that persists even after all feasible safeguards and mitigations have been implemented.

Question 2

Under California's CPRA, which agency is responsible for establishing rules around privacy risk assessments for certain high-risk processing activities?

Accepted Answer

California Privacy Protection Agency (CPPA)

Answer

The CPRA established the California Privacy Protection Agency (CPPA), which is authorized to issue regulations requiring privacy risk assessments for high-risk data processing activities.

Question 3

An organization's DPIA reveals that a new loyalty program will involve tracking customer locations throughout the day. Which privacy risk category does this MOST directly implicate?

Accepted Answer

Surveillance and tracking risk resulting in potential chilling effects on behavior

Answer

Continuous location tracking enables pervasive surveillance, which can create chilling effects on individual behavior and movement — a core privacy harm category.

Question 4

What is the function of 'threat modeling' within an impact assessment for a data-intensive system?

Accepted Answer

Systematically identifying potential adversaries, attack vectors, and privacy harms they could cause

Answer

Threat modeling identifies who might seek to misuse data, how they could do so, and what privacy harms could result — informing the risk assessment phase of the DPIA.

Question 5

A multinational organization operates across the EU, US, and Brazil. When conducting an impact assessment, which regulatory framework should guide the assessment of Brazilian data subjects' privacy risks?

Accepted Answer

Lei Geral de Proteção de Dados (LGPD)

Answer

Brazil's LGPD governs the processing of personal data of individuals located in Brazil and requires its own compliance analysis separate from GDPR or US state laws.

CDPSE - Certified Data Privacy Solutions Engineer Practice Test

CDPSE - Certified Data Privacy Solutions Engineer Practice Test

CDPSE Impact Assessments 5