CIPT Data Lifecycle Management and Governance 1 — Questions and Answers
Question 1: Which phase of the data lifecycle involves determining what data to collect, for what purpose, and under what legal basis?
- Data collection and creation (Correct answer)
- Data storage and maintenance
- Data archiving
- Data destruction
Correct answer: Data collection and creation
The collection and creation phase is where organizations define purpose, legal basis, and data minimization requirements before any personal data is obtained.
Question 2: A data retention policy specifies that customer purchase records must be deleted after seven years. Which principle does this policy primarily support?
- Storage limitation (data retention minimization) (Correct answer)
- Data portability
- Integrity and confidentiality
- Purpose limitation
Correct answer: Storage limitation (data retention minimization)
Storage limitation requires that personal data not be kept longer than necessary for its specified purpose, as defined in a documented retention schedule.
Question 3: What is a data inventory (or data map) primarily used for in a privacy governance program?
- Documenting where personal data is collected, stored, processed, and shared (Correct answer)
- Tracking server uptime and performance metrics
- Auditing user login activity
- Managing software licenses
Correct answer: Documenting where personal data is collected, stored, processed, and shared
A data inventory catalogs all personal data assets, their locations, purposes, legal bases, and flows, forming the foundation for privacy compliance programs.
Question 4: Which role is typically responsible for defining data classification levels and associated handling requirements in a data governance program?
- Data owner (Correct answer)
- Data processor
- Data subject
- Data custodian
Correct answer: Data owner
The data owner (usually a business unit leader) is accountable for data classification decisions and the rules governing how data at each level must be handled.
Question 5: An organization applies different handling rules to 'confidential,' 'internal,' and 'public' data categories. What process created these distinctions?
- Data classification (Correct answer)
- Data masking
- Data lineage tracking
- Data normalization
Correct answer: Data classification
Data classification assigns sensitivity levels to data categories, enabling proportionate controls to be applied based on the level of privacy risk.
Question 6: During the data disposal phase, which method best ensures that magnetic hard drive data is unrecoverable?
- Degaussing followed by physical destruction (Correct answer)
- Standard file deletion
- Formatting the drive once
- Overwriting with zeros one time
Correct answer: Degaussing followed by physical destruction
Degaussing disrupts magnetic domains to erase data, and physical destruction ensures media cannot be reconstructed, together providing the highest assurance of unrecoverability.
CIPT Data Lifecycle Management and Governance 1
Which phase of the data lifecycle involves determining what data to collect, for what purpose, and under what legal basis?