Privacy Risk Assessment and Management Flashcards

A company processes health data for insurance purposes. Which type of risk assessment is most appropriate given the sensitivity of the data?

Answer: Data Protection Impact Assessment (DPIA)

Health data is a special category under GDPR, and processing it at scale for insurance purposes triggers the DPIA requirement due to the high privacy risk involved.

What is the purpose of privacy risk 'scenarios' in a DPIA?

Answer: To describe specific ways that identified threats could materialize and cause harm to data subjects

Risk scenarios translate abstract threats into concrete narratives showing how a vulnerability could be exploited and what harm would result for individuals.

Which approach involves transferring privacy risk to a third party, such as through cyber liability insurance or vendor contractual indemnification?

Answer: Risk transfer

Risk transfer shifts financial or operational consequence of a privacy risk to another party but does not eliminate the underlying risk to data subjects.

A CIPT recommends conducting a privacy risk assessment before integrating a new third-party analytics SDK into a mobile app. Why is this timing important?

Answer: Early assessment allows risks to be designed out before integration, reducing cost and rework

Identifying privacy risks before integration enables design-stage mitigations, which are far less costly than architectural changes after the SDK is live in production.

What is the function of 'privacy threat modeling' in system development?

Answer: Systematically identifying privacy threats specific to a system's data flows and architecture

Privacy threat modeling (e.g., using LINDDUN) analyzes a system's data flow diagrams to surface privacy-specific threats such as linkability, identifiability, and disclosure.

Which risk management output formally documents an organization's decision to accept a specific privacy risk and who authorized that decision?

Answer: Risk acceptance record (or risk acceptance sign-off)

A risk acceptance record documents that the risk was reviewed, the residual risk level was understood, and a named accountable person formally approved accepting it.