CIPT Privacy Risk Assessment and Management 3

Question 1

A company processes health data for insurance purposes. Which type of risk assessment is most appropriate given the sensitivity of the data?

Accepted Answer

Data Protection Impact Assessment (DPIA)

Answer

Health data is a special category under GDPR, and processing it at scale for insurance purposes triggers the DPIA requirement due to the high privacy risk involved.

Question 2

What is the purpose of privacy risk 'scenarios' in a DPIA?

Accepted Answer

To describe specific ways that identified threats could materialize and cause harm to data subjects

Answer

Risk scenarios translate abstract threats into concrete narratives showing how a vulnerability could be exploited and what harm would result for individuals.

Question 3

Which approach involves transferring privacy risk to a third party, such as through cyber liability insurance or vendor contractual indemnification?

Accepted Answer

Risk transfer

Answer

Risk transfer shifts financial or operational consequence of a privacy risk to another party but does not eliminate the underlying risk to data subjects.

Question 4

A CIPT recommends conducting a privacy risk assessment before integrating a new third-party analytics SDK into a mobile app. Why is this timing important?

Accepted Answer

Early assessment allows risks to be designed out before integration, reducing cost and rework

Answer

Identifying privacy risks before integration enables design-stage mitigations, which are far less costly than architectural changes after the SDK is live in production.

Question 5

What is the function of 'privacy threat modeling' in system development?

Accepted Answer

Systematically identifying privacy threats specific to a system's data flows and architecture

Answer

Privacy threat modeling (e.g., using LINDDUN) analyzes a system's data flow diagrams to surface privacy-specific threats such as linkability, identifiability, and disclosure.

CIPT - Certified Information Privacy Technologist Practice Test

CIPT - Certified Information Privacy Technologist Practice Test

CIPT Privacy Risk Assessment and Management 3