CIPM Privacy Risk Management Flashcards

What is the primary purpose of a Privacy Impact Assessment (PIA)?

Answer: To identify and mitigate privacy risks before implementing a new project or system

A PIA systematically identifies privacy risks associated with a new project, product, or process and proposes measures to mitigate those risks before implementation.

Under GDPR, what is a Data Protection Impact Assessment (DPIA) specifically designed to address?

Answer: Processing operations likely to result in high risk to individuals' rights and freedoms

GDPR Article 35 requires a DPIA for processing operations that are likely to result in high risk to the rights and freedoms of natural persons.

Which of the following scenarios mandates a DPIA under GDPR?

Answer: Large-scale processing of special categories of personal data

GDPR Article 35(3) explicitly requires DPIAs for large-scale processing of special categories of data such as health, biometric, or racial data.

In privacy risk management, what does 'inherent risk' refer to?

Answer: The level of risk present before any controls or mitigations are applied

Inherent risk is the raw level of risk associated with a processing activity before any privacy or security controls are applied to reduce it.

Which NIST publication provides a voluntary privacy framework to help organizations manage privacy risk?

Answer: NIST Privacy Framework Version 1.0

The NIST Privacy Framework Version 1.0, published in January 2020, provides a voluntary, flexible tool for organizations to manage privacy risk through five functions: Identify, Govern, Control, Communicate, and Protect.

What is 'residual risk' in the context of a privacy risk management program?

Answer: The risk that remains after privacy controls and mitigations have been applied

Residual risk is the level of risk that remains after the organization has implemented its chosen controls and mitigation measures, which management must accept or address further.