CDPSE Incident Response 2

Question 1

Under the GDPR, what is the maximum time allowed to notify the supervisory authority after becoming aware of a personal data breach?

Accepted Answer

72 hours

Answer

GDPR Article 33 requires notification to the supervisory authority within 72 hours of becoming aware of a personal data breach.

Question 2

Which element is MOST critical to include in an initial breach notification to affected individuals?

Accepted Answer

Steps individuals can take to protect themselves

Answer

Notifications to individuals must include actionable steps they can take to mitigate potential harm to themselves.

Question 3

A company discovers that encrypted backup tapes containing personal data were lost during shipping. Under most privacy frameworks, what is the FIRST factor to assess?

Accepted Answer

Whether the encryption renders the data unintelligible to unauthorized parties

Answer

Strong encryption that renders data unintelligible to unauthorized parties may eliminate or reduce the notification obligation under many frameworks.

Question 4

Which of the following best describes 'containment' in the context of a privacy incident response?

Accepted Answer

Limiting further unauthorized access or spread of exposed personal data

Answer

Containment focuses on stopping the incident from worsening by limiting further exposure or unauthorized access to personal data.

Question 5

A privacy engineer is reviewing an incident response plan. Which phase should include updating privacy impact assessments and patching vulnerabilities?

Accepted Answer

Post-incident recovery and lessons learned

Answer

The post-incident phase involves remediation activities such as updating PIAs, patching vulnerabilities, and improving controls based on lessons learned.

CDPSE - Certified Data Privacy Solutions Engineer Practice Test

CDPSE - Certified Data Privacy Solutions Engineer Practice Test

CDPSE Incident Response 2