CIPT Privacy Risk Assessment and Management 3

Question 1

A company processes health data for insurance purposes. Which type of risk assessment is most appropriate given the sensitivity of the data?

Accepted Answer

Data Protection Impact Assessment (DPIA)

Answer

Business continuity assessment

Answer

Financial risk audit

Answer

Penetration test only

Question 2

What is the purpose of privacy risk 'scenarios' in a DPIA?

Accepted Answer

To describe specific ways that identified threats could materialize and cause harm to data subjects

Answer

To estimate the financial cost of compliance

Answer

To list all technical security controls in place

Answer

To document regulatory fines received in the past year

Question 3

Which approach involves transferring privacy risk to a third party, such as through cyber liability insurance or vendor contractual indemnification?

Accepted Answer

Risk transfer

Answer

Risk avoidance

Answer

Risk acceptance

Answer

Risk mitigation

Question 4

A CIPT recommends conducting a privacy risk assessment before integrating a new third-party analytics SDK into a mobile app. Why is this timing important?

Accepted Answer

Early assessment allows risks to be designed out before integration, reducing cost and rework

Answer

Post-launch assessments are required by law

Answer

SDKs are always low-risk and only need review after user complaints

Answer

Assessment timing does not affect remediation costs

Question 5

What is the function of 'privacy threat modeling' in system development?

Accepted Answer

Systematically identifying privacy threats specific to a system's data flows and architecture

Answer

Writing user-facing privacy notices

Answer

Encrypting all data fields in the database

Answer

Documenting regulatory requirements applicable to the system

Question 6

Which risk management output formally documents an organization's decision to accept a specific privacy risk and who authorized that decision?

Accepted Answer

Risk acceptance record (or risk acceptance sign-off)

Answer

Privacy policy update

Answer

Incident response plan

Answer

Vendor due diligence report