Privacy Risk Assessment and Management Flashcards

Which element must be included in a DPIA report according to GDPR Article 35?

Answer: A description of the processing, necessity assessment, risk evaluation, and planned mitigation measures

GDPR Article 35 specifies that a DPIA must include: a description of the processing, assessment of necessity and proportionality, risk assessment, and the measures to address risks.

When must an organization consult with the supervisory authority (e.g., a DPA) after completing a DPIA?

Answer: When the DPIA indicates a high residual risk that the organization cannot sufficiently mitigate

Prior consultation with the supervisory authority is required when the DPIA shows that high risks remain after the organization's mitigation efforts.

A privacy risk register documents identified risks, their scores, and assigned owners. What is the primary benefit of maintaining this register?

Answer: Enables tracking of risk treatment progress and accountability over time

A risk register creates an auditable record of known risks, their status, and who is responsible for treatment, supporting continuous privacy risk management.

Which privacy threat category involves an attacker combining publicly available data from multiple sources to re-identify an anonymized individual?

Answer: Aggregation attack

An aggregation attack combines individually harmless data elements from multiple sources to reconstruct a person's identity or sensitive information.

In privacy risk management, what does 'risk tolerance' define?

Answer: The level of risk the organization is willing to accept without further treatment

Risk tolerance sets the boundary between acceptable and unacceptable risk, guiding decisions about whether residual risks require further mitigation or can be accepted.

Which privacy risk factor specifically relates to the harm an individual may suffer if their personal data is exposed or misused?

Answer: Impact to data subjects

Privacy risk assessment must center on the potential harm to individuals — including financial loss, discrimination, or reputational damage — not just organizational risk.