CIPT Privacy Risk Assessment and Management

Question 1

What is the primary objective of a Data Protection Impact Assessment (DPIA)?

Accepted Answer

Identify and mitigate privacy risks of high-risk processing activities before they begin

Answer

A DPIA systematically analyzes how a high-risk processing activity will affect individual privacy and requires implementing measures to reduce identified risks.

Question 2

Which factor most commonly triggers the requirement to conduct a DPIA under GDPR?

Accepted Answer

Systematic and large-scale processing of sensitive personal data

Answer

GDPR Article 35 requires a DPIA when processing is likely to result in high risk, particularly for large-scale processing of special category data or systematic profiling.

Question 3

In a privacy risk assessment, what is a 'threat' in relation to personal data?

Accepted Answer

Any potential cause of an unwanted event that could result in privacy harm to individuals

Answer

A threat is a potential event or action — such as unauthorized access or insider misuse — that could exploit a vulnerability and cause privacy harm.

Question 4

Which risk treatment option involves stopping a high-risk data processing activity because residual risk cannot be reduced to an acceptable level?

Accepted Answer

Risk avoidance

Answer

Risk avoidance means ceasing or not starting the processing activity entirely when the risk cannot be adequately controlled.

Question 5

A privacy risk assessment rates risks using 'likelihood' and 'impact'. What does the combination of these two factors produce?

Accepted Answer

A risk score or risk level

Answer

Risk level = likelihood × impact; this score prioritizes which risks require immediate mitigation versus those that can be monitored.

CIPT - Certified Information Privacy Technologist Practice Test

CIPT - Certified Information Privacy Technologist Practice Test

CIPT Privacy Risk Assessment and Management