CIPT Privacy Risk Assessment and Management 2

Question 1

Which element must be included in a DPIA report according to GDPR Article 35?

Accepted Answer

A description of the processing, necessity assessment, risk evaluation, and planned mitigation measures

Answer

GDPR Article 35 specifies that a DPIA must include: a description of the processing, assessment of necessity and proportionality, risk assessment, and the measures to address risks.

Question 2

When must an organization consult with the supervisory authority (e.g., a DPA) after completing a DPIA?

Accepted Answer

When the DPIA indicates a high residual risk that the organization cannot sufficiently mitigate

Answer

Prior consultation with the supervisory authority is required when the DPIA shows that high risks remain after the organization's mitigation efforts.

Question 3

A privacy risk register documents identified risks, their scores, and assigned owners. What is the primary benefit of maintaining this register?

Accepted Answer

Enables tracking of risk treatment progress and accountability over time

Answer

A risk register creates an auditable record of known risks, their status, and who is responsible for treatment, supporting continuous privacy risk management.

Question 4

Which privacy threat category involves an attacker combining publicly available data from multiple sources to re-identify an anonymized individual?

Accepted Answer

Aggregation attack

Answer

An aggregation attack combines individually harmless data elements from multiple sources to reconstruct a person's identity or sensitive information.

Question 5

In privacy risk management, what does 'risk tolerance' define?

Accepted Answer

The level of risk the organization is willing to accept without further treatment

Answer

Risk tolerance sets the boundary between acceptable and unacceptable risk, guiding decisions about whether residual risks require further mitigation or can be accepted.

CIPT - Certified Information Privacy Technologist Practice Test

CIPT - Certified Information Privacy Technologist Practice Test

CIPT Privacy Risk Assessment and Management 2