CIPT Privacy Risk Assessment and Management 2

Question 1

Which element must be included in a DPIA report according to GDPR Article 35?

Accepted Answer

A description of the processing, necessity assessment, risk evaluation, and planned mitigation measures

Answer

Only the names of the data subjects affected

Answer

A list of all system vulnerabilities discovered during testing

Answer

The organization's annual privacy budget

Question 2

When must an organization consult with the supervisory authority (e.g., a DPA) after completing a DPIA?

Accepted Answer

When the DPIA indicates a high residual risk that the organization cannot sufficiently mitigate

Answer

After every DPIA regardless of the findings

Answer

Only when a data breach has already occurred

Answer

When processing data of fewer than 500 individuals

Question 3

A privacy risk register documents identified risks, their scores, and assigned owners. What is the primary benefit of maintaining this register?

Accepted Answer

Enables tracking of risk treatment progress and accountability over time

Answer

Replaces the need for technical security controls

Answer

Satisfies all GDPR documentation requirements

Answer

Provides legal immunity in case of a breach

Question 4

Which privacy threat category involves an attacker combining publicly available data from multiple sources to re-identify an anonymized individual?

Accepted Answer

Aggregation attack

Answer

SQL injection

Answer

Phishing attack

Answer

Man-in-the-middle attack

Question 5

In privacy risk management, what does 'risk tolerance' define?

Accepted Answer

The level of risk the organization is willing to accept without further treatment

Answer

The maximum financial penalty a regulator can impose

Answer

The number of data breaches an organization can absorb annually

Answer

The technical threshold for encryption key length

Question 6

Which privacy risk factor specifically relates to the harm an individual may suffer if their personal data is exposed or misused?

Accepted Answer

Impact to data subjects

Answer

Threat likelihood

Answer

Vulnerability severity

Answer

Organizational reputational risk