CIPM Study Guide 2026

A data retention schedule maps each category of data to its mandated or appropriate retention period and the method of secure disposal at end of life.

Statistical significance indicates that an observed result is unlikely to have occurred by random chance, typically when the p-value is less than 0.05 (5% probability of occurring by chance).

The most effective approach combines theoretical understanding with practical application, reinforced by regular review and assessment, enabling deeper comprehension and long-term retention.

Crafting policies which ensure minimal data is collected is least likely to be achieved by implementing a Data Lifecycle Management (DLM) program, as it is more related to the data collection stage, not the data management stage. A DLM program focuses on how to handle the data after it has been collected, such as how to store, use, share, and dispose of it. The other options are more likely to be achieved by implementing a DLM program, as they help to optimize the data storage costs, comply with the data retention obligations, and protect the data confidentiality.

Threat modeling proactively identifies potential adversaries, attack vectors, and vulnerabilities that could compromise personal data, enabling the design of appropriate preventive controls.

Residual risk is the level of risk that remains after the organization has implemented its chosen controls and mitigation measures, which management must accept or address further.