CIPT Certified Information Privacy Technologist: Privacy Technology and Data Protection Principles 3 — Questions and Answers
Question 1: K-anonymity ensures that any individual in a dataset is indistinguishable from at least how many other individuals with respect to quasi-identifiers?
- k-1
- k (Correct answer)
- k+1
- 2k
Correct answer: k
In a k-anonymous dataset, every record shares the same quasi-identifier values with at least k-1 other records, making the group size at least k.
Question 2: Which privacy control restricts what a requesting application or user can see based on a defined need-to-know policy?
- Data retention policy
- Role-based access control (RBAC) (Correct answer)
- Data portability
- Breach notification
Correct answer: Role-based access control (RBAC)
RBAC grants access to personal data only to roles with a legitimate need, limiting exposure and supporting least-privilege principles.
Question 3: A developer implements a feature where users can download all their personal data in a machine-readable format. This satisfies which data subject right?
- Right to erasure
- Right to data portability (Correct answer)
- Right to restriction
- Right to object
Correct answer: Right to data portability
The right to data portability under GDPR Article 20 allows individuals to receive their data in a structured, commonly used format.
Question 4: Which concept describes building privacy protections directly into IT systems and business practices from the outset?
- Security by obscurity
- Privacy by Design (Correct answer)
- Data governance
- Consent management
Correct answer: Privacy by Design
Privacy by Design, developed by Ann Cavoukian, embeds privacy proactively into system design rather than adding it as an afterthought.
Question 5: Secure multi-party computation (SMPC) allows multiple parties to jointly compute a function over their inputs while keeping those inputs what?
- Publicly accessible
- Private from each other (Correct answer)
- Centrally stored
- Encrypted only at rest
Correct answer: Private from each other
SMPC enables collaborative computation so that no participant learns the other parties' private inputs.
Question 6: Which principle requires that personal data not be kept longer than necessary for its stated purpose?
- Data accuracy
- Purpose limitation
- Storage limitation (Correct answer)
- Integrity and confidentiality
Correct answer: Storage limitation
The storage limitation principle mandates that personal data be deleted or anonymized once it is no longer needed for its original purpose.
Question 7: An organization discovers that a third-party vendor leaked customer records. Under the GDPR, what is the controller's notification deadline to the supervisory authority?
- 24 hours
- 48 hours
- 72 hours (Correct answer)
- 30 days
Correct answer: 72 hours
GDPR Article 33 requires controllers to notify their supervisory authority of a personal data breach within 72 hours of becoming aware of it.
CIPT Certified Information Privacy Technologist: Privacy Technology and Data Protection Principles 3
K-anonymity ensures that any individual in a dataset is indistinguishable from at least how many other individuals with respect to quasi-identifiers?