CIPM CIPM Privacy Risk Management 1

Question 1

What is the primary purpose of a Privacy Impact Assessment (PIA)?

Accepted Answer

To identify and mitigate privacy risks before implementing a new project or system

Answer

A PIA systematically identifies privacy risks associated with a new project, product, or process and proposes measures to mitigate those risks before implementation.

Question 2

Under GDPR, what is a Data Protection Impact Assessment (DPIA) specifically designed to address?

Accepted Answer

Processing operations likely to result in high risk to individuals' rights and freedoms

Answer

GDPR Article 35 requires a DPIA for processing operations that are likely to result in high risk to the rights and freedoms of natural persons.

Question 3

Which of the following scenarios mandates a DPIA under GDPR?

Accepted Answer

Large-scale processing of special categories of personal data

Answer

GDPR Article 35(3) explicitly requires DPIAs for large-scale processing of special categories of data such as health, biometric, or racial data.

Question 4

In privacy risk management, what does 'inherent risk' refer to?

Accepted Answer

The level of risk present before any controls or mitigations are applied

Answer

Inherent risk is the raw level of risk associated with a processing activity before any privacy or security controls are applied to reduce it.

Question 5

Which NIST publication provides a voluntary privacy framework to help organizations manage privacy risk?

Accepted Answer

NIST Privacy Framework Version 1.0

Answer

The NIST Privacy Framework Version 1.0, published in January 2020, provides a voluntary, flexible tool for organizations to manage privacy risk through five functions: Identify, Govern, Control, Communicate, and Protect.

CIPM - Certified Information Privacy Manager Practice Test

CIPM - Certified Information Privacy Manager Practice Test

CIPM CIPM Privacy Risk Management 1