CIPT Data Lifecycle Management and Governance 2

Question 1

What is the purpose of a data processing agreement (DPA) between a controller and a processor?

Accepted Answer

To contractually bind the processor to process data only on documented instructions and implement adequate safeguards

Answer

To transfer data ownership from controller to processor

Answer

To allow the processor to sell data to third parties

Answer

To replace a privacy policy for end users

Question 2

A company maintains records of all its data processing activities including purposes, categories of data, and retention periods. What is this record called?

Accepted Answer

Record of Processing Activities (RoPA)

Answer

Privacy impact assessment

Answer

Data breach register

Answer

Information security policy

Question 3

Which concept describes tracking the origin, movement, and transformations of data across its entire lifecycle within an organization?

Accepted Answer

Data lineage

Answer

Data provenance auditing

Answer

Database versioning

Answer

Change data capture

Question 4

An organization must delete a customer's data upon request. Which governance process ensures all copies — including backups — are identified and removed?

Accepted Answer

Data mapping combined with a defined erasure workflow

Answer

Deleting only the primary production record

Answer

Issuing a SQL DELETE command on the main database

Answer

Waiting for backup rotation to naturally overwrite data

Question 5

What does 'data sovereignty' mean in the context of data governance?

Accepted Answer

Data is subject to the laws of the country in which it is collected or stored

Answer

The organization owns all data it collects indefinitely

Answer

Users can export their data in any format they choose

Answer

Data must be stored on on-premises servers only

Question 6

Which governance mechanism ensures that personal data collected for one purpose is not used for an incompatible second purpose?

Accepted Answer

Purpose limitation controls

Answer

Data retention policies

Answer

Encryption at rest

Answer

Role-based access control