Data Lifecycle Management and Governance Flashcards

A privacy governance framework assigns a Chief Privacy Officer (CPO). What is the CPO's primary organizational responsibility?

Answer: Leading the organization's privacy strategy and ensuring enterprise-wide compliance

The CPO sets privacy strategy, oversees compliance programs, advises leadership, and is ultimately accountable for the organization's privacy posture.

Which data governance artifact defines who can access specific datasets, under what conditions, and for what approved purposes?

Answer: Data access policy

A data access policy specifies authorization rules, access conditions, and approved purposes for each data category, supporting both governance and privacy compliance.

What is the primary risk of 'data sprawl' from a privacy governance perspective?

Answer: Uncontrolled copies of personal data spread across systems, increasing breach surface and erasure complexity

Data sprawl creates untracked copies of personal data that may not be covered by security controls or erasure workflows, elevating privacy risk.

An organization implements automated data expiry rules that delete personal records when their retention period ends. What governance benefit does this provide?

Answer: Reduces risk of holding data beyond its legal or business justification

Automated retention enforcement ensures data is not held longer than necessary, reducing regulatory exposure and minimizing the dataset affected in a breach.

In a data governance program, what is the role of a 'data steward'?

Answer: Managing day-to-day data quality, classification, and compliance for a specific dataset or domain

Data stewards are operational custodians who enforce data governance policies, maintain data quality, and ensure day-to-day compliance within their assigned data domain.

Which process ensures that third-party vendors who access personal data meet the organization's privacy and security standards before contracting?

Answer: Vendor privacy due diligence (third-party risk assessment)

Third-party privacy due diligence evaluates vendors' privacy practices, security controls, and compliance posture before sharing personal data with them.