CIPM Privacy Risk Management Flashcards

In privacy risk assessment, what is meant by 'privacy harm'?

Answer: Adverse impacts on individuals resulting from the processing of their personal data

Privacy harm refers to the negative consequences experienced by individuals — such as discrimination, financial loss, or reputational damage — that result from the processing of their personal information.

Which GDPR criteria help determine whether a DPIA is required for a processing activity?

Answer: Systematic and extensive profiling, large-scale processing of special data, or systematic monitoring of public areas

GDPR Article 35 and WP29 guidelines identify high-risk criteria including large-scale special category data processing, systematic profiling, and systematic monitoring of publicly accessible areas.

What does 'residual risk acceptance' mean in a privacy risk management program?

Answer: Management's formal decision to tolerate remaining risk after controls have been applied

Residual risk acceptance is a formal management decision acknowledging that the remaining risk after controls is within the organization's risk appetite and does not require further mitigation.

How should an organization prioritize privacy risks identified during an assessment?

Answer: By evaluating the likelihood of harm and the severity of impact on data subjects

Privacy risk prioritization involves assessing both the probability that harm will occur and the severity of that harm to individuals, enabling resources to focus on the highest-impact risks first.

How does a Record of Processing Activities (RoPA) support an organization's privacy risk management?

Answer: It provides a comprehensive inventory of processing activities that enables risk identification and assessment

A RoPA required by GDPR Article 30 documents all processing activities, enabling organizations to identify which activities present privacy risks and prioritize them for assessment and control.

What is the function of a privacy risk register in an organizational privacy program?

Answer: To document identified privacy risks, their likelihood, impact, owners, and the status of mitigation actions

A privacy risk register is a centralized repository that tracks identified privacy risks, their likelihood and impact ratings, assigned risk owners, chosen treatments, and the current status of mitigations.