CDPSE Risk Management 5

Question 1

Which of the following BEST describes the difference between a privacy risk assessment and a Data Protection Impact Assessment (DPIA)?

Accepted Answer

A DPIA is legally mandated for high-risk processing under GDPR, while a privacy risk assessment is a general best-practice tool

Answer

Under GDPR Article 35, a DPIA is legally required for high-risk processing activities, whereas a privacy risk assessment is a broader, framework-agnostic practice.

Question 2

An organization processes personal data in Country A and transfers it to a processor in Country B, which lacks an adequacy decision. What privacy risk does this introduce?

Accepted Answer

Risk of non-compliance with data transfer restrictions and inadequate protection standards

Answer

Transferring data to a country without an adequacy decision creates legal and protection-level risk, requiring additional safeguards such as Standard Contractual Clauses.

Question 3

A CDPSE is evaluating privacy risks associated with a biometric authentication system. Which risk is MOST specific to biometric data?

Accepted Answer

Risk of irreversible harm since biometric data cannot be changed if compromised

Answer

Unlike passwords, biometric identifiers (fingerprints, facial features) are permanent; a compromise creates lifelong risk because they cannot be reset.

Question 4

Which of the following scenarios BEST demonstrates the concept of 'data minimization' as a risk control?

Accepted Answer

Collecting only the personal data fields strictly necessary for the stated purpose

Answer

Data minimization reduces privacy risk by limiting the volume and sensitivity of personal data held, thereby reducing the potential impact of a breach or misuse.

Question 5

A CDPSE is performing a risk assessment on an employee monitoring program. Which factor is MOST critical to evaluate for privacy risk?

Accepted Answer

The proportionality of monitoring scope relative to its stated business purpose

Answer

Proportionality—whether the intrusiveness of monitoring is justified by the business purpose—is the central privacy risk factor in employee monitoring programs.

CDPSE - Certified Data Privacy Solutions Engineer Practice Test

CDPSE - Certified Data Privacy Solutions Engineer Practice Test

CDPSE Risk Management 5