CIPT Privacy Risk Assessment and Management

Question 1

What is the primary objective of a Data Protection Impact Assessment (DPIA)?

Accepted Answer

Identify and mitigate privacy risks of high-risk processing activities before they begin

Answer

Document data breaches for regulatory reporting

Answer

Audit employee compliance with data handling policies

Answer

Calculate the financial cost of a potential data breach

Question 2

Which factor most commonly triggers the requirement to conduct a DPIA under GDPR?

Accepted Answer

Systematic and large-scale processing of sensitive personal data

Answer

Processing data for payroll purposes

Answer

Storing employee email addresses

Answer

Publishing a public website privacy policy

Question 3

In a privacy risk assessment, what is a 'threat' in relation to personal data?

Accepted Answer

Any potential cause of an unwanted event that could result in privacy harm to individuals

Answer

A known vulnerability in software code

Answer

A regulatory fine imposed by a supervisory authority

Answer

A negative user review about data practices

Question 4

Which risk treatment option involves stopping a high-risk data processing activity because residual risk cannot be reduced to an acceptable level?

Accepted Answer

Risk avoidance

Answer

Risk transfer

Answer

Risk acceptance

Answer

Risk mitigation

Question 5

A privacy risk assessment rates risks using 'likelihood' and 'impact'. What does the combination of these two factors produce?

Accepted Answer

A risk score or risk level

Answer

A compliance checklist

Answer

A data flow diagram

Answer

A breach notification timeline

Question 6

What is 'residual risk' in the context of privacy risk management?

Accepted Answer

The remaining risk after controls and mitigations have been applied

Answer

The initial risk before any controls are considered

Answer

The total financial exposure from a data breach

Answer

The risk transferred to cyber insurance