CDPSE Certified Data Privacy Solutions Engineer Questions and Answers

Online behavioral tracking is a tracking technology associated with unsolicited targeted advertisements that presents the greatest privacy risk. Online behavioral tracking is a technique that collects and analyzes personal data about users’ online activities, preferences, interests, and behaviors across different websites or platforms. Online behavioral tracking is used to create user profiles and deliver personalized or targeted advertisements that match users’ needs or wants. Online behavioral tracking poses a privacy risk because it can invade users’ privacy by collecting sensitive or intimate personal data without their knowledge or consent, such as health conditions, political views, sexual orientation, etc. Online behavioral tracking can also expose users to unwanted or inappropriate advertisements that may influence their decisions or actions. References: : CDPSE Review Manual (Digital Version), page 139

Consent tagging is a metadata-driven process that associates consent preferences with an individual’s data, enabling organizations to manage consent dynamically across systems. It is not limited to cookies (A), one-time logging (C), or initial requests (D).

“Consent tagging links an individual’s data with their recorded consent choices for compliant processing.”

The data controller determines the purposes and means of processing and therefore retains primary accountability for risk—even if a processor or custodian executes processing. Data processors (C) act under instructions; custodians (A) safeguard data but do not define processing; data scientists (B) are operational users, not accountable owners.

“The data controller remains accountable for compliance and risk regardless of outsourcing processing activities.”

Incorporating privacy checkpoints into the secure development life cycle (SDLC) is the best way to avoid collecting personal data that was not part of the privacy impact assessment (PIA). Privacy checkpoints are stages in the SDLC where privacy requirements and risks are reviewed and validated, and any changes or deviations from the original PIA are identified and addressed. Privacy checkpoints help ensure that privacy is embedded throughout the system design and development, and that any changes are documented and approved.

Cryptographic erasure is a data sanitization method that uses encryption to render data unreadable and unrecoverable. It is the best method when there is a need to balance the destruction of data and the ability to recycle IT assets, because it does not damage the storage media and allows it to be reused or sold. It is also faster and more environmentally friendly than physical destruction methods.

User consent to share personal data is the most important factor when designing APIs that enable mobile device applications to access personal data, as it ensures that the user is informed and agrees to the purpose, scope, and duration of the data sharing. User consent also helps to comply with the data protection principles and regulations, such as the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA), that require user consent for certain types of data processing and sharing134. References: 1 Domain 2, Task 7

The use of personal data in model training is the primary privacy risk with LLMs, since once trained, models may retain, reproduce, or infer personal data without proper controls. Hallucinations (B), expertise shortages (C), and interoperability issues (D) are operational or performance risks, but not privacy risks.

“Training models on personal data can result in unintended retention, exposure, or disclosure of sensitive information.”

De-identification is a technique that removes or modifies direct and indirect identifiers in a data set to prevent or limit the identification of the data subjects. De-identification reduces the risk of re-identification and thus limits the organization’s potential exposure in the event of consumer data loss. De-identification also maintains the traceability of the data by preserving some characteristics or patterns of the original data that can be used for analysis or research purposes. The other options are not effective ways to limit exposure and maintain traceability1, p. 75-76 References: 1: CDPSE Review Manual (Digital Version)

Data privacy standards are the set of rules, guidelines, and best practices that define the requirements and expectations for the collection, processing, storage, sharing, and disposal of personal data. Data privacy standards help to ensure that personal data is treated in a fair, lawful, transparent, and secure manner, as well as to comply with the applicable privacy laws and regulations. Data privacy standards also help to define the data retention time in a stream-fed data lake that includes personal data, as they specify the criteria and conditions for how long personal data can be kept in the data lake, based on factors such as the purpose, necessity, relevance, and quality of the data. Data retention time is an important aspect of data privacy, as it affects the risk of data breaches, unauthorized access, or misuse of personal data.

Remote employee monitoring software is a solution that collects, analyzes and reports data on the activities and behaviors of employees who work remotely or from home. It can help organizations to measure and improve employee productivity, performance, engagement and security. However, it also poses significant privacy risks and challenges, as it may involve the collection and processing of personal data, such as names, email addresses, biometric data, IP addresses, keystrokes, screenshots, web browsing history, app usage, communication content and frequency, etc.

Data access should be restricted based on roles, meaning that only authorized and legitimate parties should be able to access and use the data collected by the remote employee monitoring software, based on their roles and responsibilities within the organization. This is a key privacy principle and practice that helps to protect the privacy rights and interests of the employees, and to prevent unauthorized or excessive access, use, disclosure or modification of their personal data by the organization or third parties. Data access restriction based on roles also helps to comply with data protection laws and regulations, such as the General Data Protection Regulation (GDPR) or the California Consumer Privacy Act (CCPA), which require data controllers and processors to implement appropriate technical and organizational measures to safeguard personal data.

Zero-knowledge proofs (ZKPs) allow a party to prove possession of a secret or attribute without revealing the secret itself, enabling privacy-preserving verification. Digital signatures (A) and PGP (B) still involve exposure of certain data elements/keys for validation; passwordless methods (D) change authentication factors, not zero-knowledge verification.

“Zero-knowledge proofs enable verification without disclosure of the underlying data.”

Validating the privacy framework is a responsibility of the audit function in helping an organization address privacy compliance requirements, as it would help to verify and validate the effectiveness and adequacy of the privacy framework implemented by the organization to comply with privacy principles, laws and regulations. Validating the privacy framework would also help to identify and report any gaps, weaknesses or issues in the privacy framework, and to provide recommendations for improvement or remediation. The other options are not responsibilities of the audit function in helping an organization address privacy compliance requirements. Approving privacy impact assessments (PIAs) is a responsibility of management or governance function in helping an organization address privacy compliance requirements, as they would have authority and accountability for approving PIAs conducted by project teams or business units before implementing any system, project, program or initiative that involves personal data processing activities. Managing privacy notices provided to customers is a responsibility of operational function in helping an organization address privacy compliance requirements, as they would have direct contact and interaction with customers and would be responsible for providing clear and accurate information about how their personal data is collected, used, disclosed and transferred by the organization. 

The answer is B. Personal data could potentially be exfiltrated through the virtual workspace.

A comprehensive explanation is:

A virtualized workspace is a cloud-based service that provides remote access to a desktop environment, applications, and data. A virtualized workspace can enable software development teams to collaborate and work efficiently across different locations and devices. However, a virtualized workspace also poses significant privacy risks, especially when it is implemented by a third-party provider.

One of the greatest privacy concerns of using a third-party virtualized workspace is the potential for personal data to be exfiltrated through the virtual workspace. Personal data is any information that relates to an identified or identifiable individual, such as name, email, address, phone number, etc. Personal data can be collected, stored, processed, or transmitted by the software development organization or its clients, partners, or users. Personal data can also be generated or inferred by the software development activities or products.

Personal data can be exfiltrated through the virtual workspace by various means, such as:

Data breaches: A data breach is an unauthorized or unlawful access to or disclosure of personal data. A data breach can occur due to weak security measures, misconfiguration errors, human errors, malicious attacks, or insider threats. A data breach can expose personal data to hackers, competitors, regulators, or other parties who may use it for harmful purposes.

Data leakage: Data leakage is an unintentional or accidental transfer of personal data outside the intended boundaries of the organization or the virtual workspace. Data leakage can occur due to improper disposal of devices or media, insecure network connections, unencrypted data transfers, unauthorized file sharing, or careless user behavior. Data leakage can compromise personal data to third parties who may not have adequate privacy policies or practices.

Data mining: Data mining is the analysis of large and complex data sets to discover patterns, trends, or insights. Data mining can be performed by the third-party provider of the virtual workspace or by other authorized or unauthorized parties who have access to the virtual workspace. Data mining can reveal personal data that was not explicitly provided or intended by the organization or the individuals.

The exfiltration of personal data through the virtual workspace can have serious consequences for the software development organization and its stakeholders. It can result in:

Legal liability: The organization may face legal actions or penalties for violating the privacy laws, regulations, standards, or contracts that apply to the personal data in each jurisdiction where it operates or serves. For example, the General Data Protection Regulation (GDPR) in the European Union imposes strict obligations and sanctions for protecting personal data across borders.

Reputational damage: The organization may lose trust and credibility among its clients, partners, users, employees, investors, or regulators for failing to safeguard personal data. This can affect its brand image, customer loyalty, market share, revenue, or growth potential.

Competitive disadvantage: The organization may lose its competitive edge or intellectual property if its personal data is stolen or misused by its rivals or adversaries. This can affect its innovation capability, product quality, or market differentiation.

Therefore, it is essential for the software development organization to implement appropriate measures and controls to prevent or mitigate the exfiltration of personal data through the virtual workspace. Some of these measures and controls are:

Data minimization: The organization should collect and process only the minimum amount and type of personal data that is necessary and relevant for its legitimate purposes. It should also delete or anonymize personal data when it is no longer needed or required.

Data encryption: The organization should encrypt personal data at rest and in transit using strong and standardized algorithms and keys. It should also ensure that only authorized parties have access to the keys and that they are stored securely.

Data segmentation: The organization should segregate personal data into different categories based on their sensitivity and risk level. It should also apply different levels of protection and access control to each category of personal data.

Data governance: The organization should establish a clear and comprehensive policy and framework for managing personal data throughout its lifecycle. It should also assign roles and responsibilities for implementing and enforcing the policy and framework.

Data audit: The organization should monitor and review the activities and events related to personal data on a regular basis. It should also conduct periodic assessments and tests to evaluate the effectiveness and compliance of its privacy measures and controls.

Data awareness: The organization should educate and train its staff and users on the importance and best practices of protecting personal data. It should also communicate and inform its clients, partners, and regulators about its privacy policies and practices.

The other options are not as great of a concern as option B.

The third-party workspace being hosted in a highly regulated jurisdiction (A) may pose some challenges for complying with different privacy laws and regulations across borders. However it may also offer some benefits such as higher standards of privacy protection and enforcement.

The organization’s products being classified as intellectual property © may increase the value and attractiveness of the personal data related to the products, but it does not necessarily increase the risk of exfiltration of the personal data through the virtual workspace.

The lack of privacy awareness and training among remote personnel (D) may increase the likelihood of human errors or negligence that could lead to exfiltration of personal data through the virtual workspace. However it is not a direct cause or source of exfiltration, and it can be addressed by providing adequate education and training.

The primary means by which an organization communicates customer rights as it relates to the use of their personal information is publishing a privacy notice. A privacy notice is a document that informs the customers about how the organization collects, uses, shares, and protects their personal information, and what rights and choices they have regarding their data4. A privacy notice is a legal requirement under many data protection laws and regulations, such as the General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), or the Personal Information Protection and Electronic Documents Act (PIPEDA)5 . A privacy notice is also a good practice to demonstrate the organization’s commitment to transparency, accountability, and customer trust. References:

ISACA Glossary of Terms

Article 13 and 14 of the GDPR

[Section 1798.100 of the CCPA]

[Schedule 1, Principle 4.8 of the PIPEDA]

[ISACA CDPSE Review Manual, Chapter 1, Section 1.3.2]

The value proposition of a PIA is not understood by management is the greatest obstacle to conducting a PIA, as it may result in lack of support, funding, resources or commitment for the PIA process and outcomes. Management may not appreciate or recognize the benefits of a PIA, such as enhancing privacy protection, reducing privacy risks and costs, increasing customer trust and satisfaction, and complying with privacy laws and regulations. Management may also perceive a PIA as a burden, a delay or a hindrance to the system or project development and delivery. The other options are not as significant as the value proposition of a PIA is not understood by management as obstacles to conducting a PIA. Conducting a PIA requires significant funding and resources is an obstacle to conducting a PIA, but it may be overcome by demonstrating the return on investment or the cost-benefit analysis of a PIA. PIAs need to be performed many times in a year is an obstacle to conducting a PIA, but it may be mitigated by adopting a scalable or modular approach to PIAs that can be tailored to different types or levels of systems or projects. The organization lacks knowledge of PIA methodology is an obstacle to conducting a PIA, but it may be resolved by acquiring or developing the necessary skills, tools or guidance for performing PIAs1, p. 67-68 References: 1: CDPSE Review Manual (Digital Version)

Data retention is a process of keeping personal data for a specified period of time for legitimate purposes, such as legal obligations, contractual agreements, business operations or historical records. Data retention should be based on the principle of data minimization, which requires limiting the collection, storage and processing of personal data to what is necessary and relevant for the intended purposes. Data retention should also comply with the principle of storage limitation, which requires deleting or disposing of personal data when it is no longer needed or justified. The most likely valid use case for keeping a customer’s personal data after contract termination is a required retention period due to regulations, such as tax laws, financial laws, health laws or consumer protection laws, that mandate the organization to retain certain types of customer data for a certain period of time after the end of the contractual relationship. The other options are not valid use cases for keeping a customer’s personal data after contract termination, as they do not meet the criteria of necessity, relevance or justification. For the purpose of medical research, the organization would need to obtain the consent of the customer or have another legal basis for processing their personal data for a different purpose than the original contract. A forthcoming campaign to win back customers or ease of onboarding when the customer returns are not legitimate purposes for retaining customer data after contract termination, as they are not related to the original contract and may violate the customer’s privacy rights and preferences. , p. 99-100 References: : CDPSE Review Manual (Digital Version)

User behavior analytics is a technology that uses data analysis and machine learning to monitor, detect and respond to anomalous or malicious user activities, such as accessing sensitive personal customer information to use for unauthorized purposes. User behavior analytics is the best choice to mitigate this risk, as it would help to identify and prevent insider threats, data breaches, fraud or misuse of data by authorized individuals. User behavior analytics can also help to enforce policies and controls, such as access control, audit trail or data loss prevention. The other options are not as effective as user behavior analytics in mitigating this risk. Email filtering system is a technology that scans and blocks incoming or outgoing emails that contain spam, malware or phishing attempts, but it does not address the issue of authorized individuals accessing sensitive personal customer information to use for unauthorized purposes. Intrusion monitoring is a technology that monitors and alerts on unauthorized or malicious attempts to access a system or network, but it does not address the issue of authorized individuals accessing sensitive personal customer information to use for unauthorized purposes. Mobile device management (MDM) is a technology that manages and secures mobile devices that are used to access or store organizational data, but it does not address the issue of authorized individuals accessing sensitive personal customer information to use for unauthorized purposes1, p. 92 References: 1: CDPSE Review Manual (Digital Version)

Providing data subjects direct access through a profile page is the best practice because it supports transparency and control while fulfilling data subject rights (e.g., access, rectification). Limiting edits (A) or disabling modifications (D) restricts rights. Using email to generate IDs (B) is unrelated to enabling data subject access.

“Data subjects should have the ability to view and manage their own information directly.”

A retention schedule is a document that specifies how long different types of records or data should be kept and when they should be deleted or disposed of, based on legal, regulatory, operational or historical requirements. A retention schedule is the best indication of an effective records management program for personal data, as it reflects the principles of data minimization and storage limitation, which require limiting the collection, storage and processing of personal data to what is necessary and relevant for the intended purposes, and deleting or disposing of personal data when it is no longer needed or justified. A retention schedule also helps to reduce the privacy risks and costs associated with data storage and retention, such as data breaches, unauthorized access, misuse or loss of data. The other options are not as indicative of an effective records management program for personal data as a retention schedule. Archived data is used for future analytics may indicate that the organization is leveraging its data assets for business intelligence or research purposes, but it may not comply with the principles of data minimization and storage limitation, or the privacy rights and preferences of the data subjects. The legal department has approved the retention policy may indicate that the organization has obtained legal advice or guidance on its records management program for personal data, but it may not reflect the actual implementation or execution of the retention policy. All sensitive data has been tagged may indicate that the organization has implemented a data classification scheme for its records or data, but it may not indicate how long the records or data should be kept or when they should be deleted or disposed of1, p. 99-100 References: 1: CDPSE Review Manual (Digital Version)

Obtaining executive support is the first step in developing an organization-wide strategy to address data privacy risk, as it ensures that the privacy program has the necessary resources, authority, and alignment with the organization’s goals and objectives. Without executive support, the privacy program may face challenges in implementing and enforcing privacy policies, procedures, and controls across the organization. References: 2 Domain 1, Task 1

Conducting a risk assessment of all candidate vendors is the best way to provide assurance that a potential vendor is able to comply with privacy regulations and the organization’s data privacy policy, because it allows the organization to evaluate the vendor’s privacy practices, controls, and performance against a set of criteria and standards. A risk assessment can also help to identify any gaps, weaknesses, or threats that may pose a risk to the organization’s data privacy objectives and obligations. A risk assessment can be based on various sources of information, such as self-attestations, documentation, audits, or independent verification. A risk assessment can also help to prioritize the vendors based on their level of risk and impact, and to determine the appropriate mitigation or monitoring actions.

From a privacy perspective, it is most important to ensure data backups are encrypted. Encryption is a process of transforming data into an unreadable form using a secret key or algorithm. Encryption can help protect the confidentiality, integrity, and availability of data backups by preventing unauthorized access, disclosure, or modification. Encryption can also help comply with legal and regulatory requirements for data protection, such as the General Data Protection Regulation (GDPR) or the Health Insurance Portability and Accountability Act (HIPAA). Encryption can be applied to data backups at different levels, such as file-level, disk-level, or network-level encryption.

Incremental backups, differential backups, or pseudonymization are also useful for data backup management, but they are not the most important from a privacy perspective. Incremental backups are backups that only copy the data that has changed since the last backup, whether it was a full, differential, or incremental backup. Incremental backups can help save storage space and time, but they do not directly protect the data from unauthorized access or disclosure. Differential backups are backups that only copy the data that has changed since the last full backup. Differential backups can also help save storage space and time, but they also do not directly protect the data from unauthorized access or disclosure. Pseudonymization is a process of replacing identifying information in data with artificial identifiers or pseudonyms. Pseudonymization can help enhance the privacy of data by reducing the linkability between data and data subjects, but it does not prevent re-identification or inference attacks.

A bug bounty program is an assurance approach that involves offering rewards to external security researchers who find and report vulnerabilities in an API or other software. A bug bounty program can be more effective than other assurance approaches in identifying API vulnerabilities because it leverages the skills, creativity, and diversity of a large pool of ethical hackers who can test the API from different perspectives and scenarios. A bug bounty program can also incentivize continuous testing and reporting of vulnerabilities, which can help improve the security posture of the API over time.

Restricting access to authorized users is the best control to secure application programming interfaces (APIs) that may contain personal information, as it would prevent unauthorized access, modification or disclosure of the personal information by third parties or intermediaries. Restricting access to authorized users can be achieved by using various methods, such as authentication, authorization, encryption, tokens or certificates. The other options are not effective controls to secure APIs that may contain personal information. Encrypting APIs with the organization’s private key is not a feasible or desirable method, as it would make the APIs unreadable by anyone who does not have the corresponding public key, which would defeat the purpose of using APIs for interoperability and integration. Requiring nondisclosure agreements (NDAs) when sharing APIs is not a reliable or enforceable method, as it would depend on the compliance and cooperation of the parties who receive the APIs, and it would not prevent unauthorized access, modification or disclosure of the personal information by third parties or intermediaries who are not bound by the NDAs. Sharing only digitally signed APIs is not a sufficient method, as it would only ensure the authenticity and integrity of the APIs, but it would not prevent unauthorized access, modification or disclosure of the personal information by third parties or intermediaries who can read or intercept the APIs1, p. 90-91 References: 1: CDPSE Review Manual (Digital Version)

The need-to-know basis principle is a security principle that states that access to personal data should be limited to those who have a legitimate purpose for accessing it. The need-to-know basis principle helps to protect data privacy by minimizing the exposure of personal data to unauthorized or unnecessary parties, reducing the risk of data breaches, leaks, or misuse. The need-to-know basis principle should be applied when designing a role-based user access model for a new application, by defining clear roles and responsibilities for different users, granting access rights based on their roles and functions, and enforcing access controls and audits to monitor and verify data access. References: : CDPSE Review Manual (Digital Version), page 105

The best way to safeguard the encryption keys is to ensure that they are stored in a cryptographic vault. A cryptographic vault is a secure hardware or software module that provides cryptographic services and protects the keys from unauthorized access, modification, or disclosure. A cryptographic vault can also provide other functions, such as key generation, key backup, key rotation, key destruction, and key auditing. A cryptographic vault can enhance the security and privacy of the encrypted data by preventing key compromise, leakage, or misuse. A cryptographic vault can also comply with the security standards and best practices for key management, such as the ISO/IEC 27002, NIST SP 800-57, or PCI DSS. References:

[ISACA Glossary of Terms]

[ISACA CDPSE Review Manual, Chapter 3, Section 3.3.3]

[ISACA Journal, Volume 4, 2019, “Key Management in the Multi-Cloud Environment”]

[ISACA CDPSE Review Manual, Chapter 3, Section 3.3.4]

The primary means by which an organization communicates customer rights as it relates to the use of their personal information is publishing a privacy notice. A privacy notice is a document that informs the customers about how their personal information is collected, used, shared, stored, and protected by the organization, as well as what rights they have regarding their personal information, such as access, rectification, erasure, portability, objection, etc. A privacy notice should be clear, concise, transparent, and easily accessible to the customers, and should comply with the applicable privacy regulations and standards. A privacy notice helps to establish trust and transparency between the organization and the customers, and enables the customers to exercise their rights and choices over their personal information. References: : CDPSE Review Manual (Digital Version), page 39

A primary objective of performing a privacy impact assessment (PIA) prior to onboarding a new Software as a Service (SaaS) provider for a customer relationship management (CRM) system is to identify controls to mitigate data privacy risks, such as data breaches, unauthorized access, misuse or loss of data. A PIA would help to evaluate the potential privacy impacts of using a new SaaS provider for CRM data processing activities, such as collecting, storing, analyzing or transferring customer data, and to implement appropriate controls to mitigate those impacts, such as encryption, access control, backup, audit trail or contractual clauses. A PIA would also help to ensure compliance with privacy principles, laws and regulations, and alignment with customer expectations and preferences. The other options are not primary objectives of performing a PIA prior to onboarding a new SaaS provider for CRM data processing activities. Classifying personal data according to the data classification scheme is an activity that may be part of a PIA process, but it is not an objective in itself. Assessing the risk associated with personal data usage is an activity that may be part of a PIA process, but it is not an objective in itself. Determining the service provider’s ability to maintain data protection controls is an activity that may be part of a PIA process, but it is not an objective in itself1, p. 67 References: 1: CDPSE Review Manual (Digital Version)

 Transparency is the most important attribute of a privacy policy because it informs the users about how their personal data is collected, used, shared, and protected by the organization. Transparency also helps to build trust and confidence with the users, and to comply with legal and ethical obligations regarding data privacy.

Data mapping is the process of defining how data elements from different sources are related, transformed, and transferred to a common destination. Data mapping is the first step when developing an application link because it helps to ensure that the data exchanged between the API and the third-party application is consistent, accurate, and compatible. Data mapping also helps to identify any gaps, errors, or conflicts in the data and resolve them before the data transfer occurs.

Requiring independent audits of the providers’ data privacy controls is the best way to ensure third-party providers that process an organization’s personal data are addressed as part of the data privacy strategy. Independent audits can verify that the providers are complying with the applicable data privacy laws and regulations, as well as the organization’s own policies and standards. Independent audits can also identify any gaps or weaknesses in the providers’ data privacy controls and recommend corrective actions or improvements.

One of the most common vulnerabilities that can compromise the access to personal information is end users using weak passwords. Weak passwords are passwords that are easy to guess, crack, or steal, such as passwords that are short, simple, common, or reused. Weak passwords can allow unauthorized or malicious parties to gain access to personal information and cause privacy breaches, leaks, or misuse. Multi-factor authentication is an effective way to mitigate this vulnerability, as it requires end users to provide more than one piece of evidence to verify their identity, such as something they know (e.g., password), something they have (e.g., token), or something they are (e.g., biometric). Multi-factor authentication makes it harder for attackers to bypass the authentication process and access personal information. References: : CDPSE Review Manual (Digital Version), page 107

The most important consideration for determining the operational life of an encryption key is the volume and sensitivity of data protected by the key. The operational life of an encryption key is the period of time during which the key can be used securely and effectively to encrypt and decrypt data. The operational life of an encryption key depends on various factors, such as the length and complexity of the key, the strength and speed of the encryption algorithm, the number and frequency of encryption operations, the number of entities involved in communication, and the number of digitally signed documents in force. However, among these factors, the volume and sensitivity of data protected by the key is the most critical, as it affects the risk and impact of a potential compromise or exposure of the key. The higher the volume and sensitivity of data protected by the key, the shorter the operational life of the key should be, as this reduces the window of opportunity for an attacker to access or misuse the data.

The primary consideration to ensure control of remote access is aligned to the privacy policy is that access is only granted to authorized users. This means that the organization should implement and enforce policies and procedures to identify, authenticate, and authorize users who need to access personal data remotely, such as employees, contractors, or service providers. The organization should also define and communicate the roles and responsibilities of remote users, and the terms and conditions of remote access, such as the purpose, scope, duration, and security measures. By granting access only to authorized users, the organization can protect data privacy by preventing unauthorized or unnecessary access, use, disclosure, or transfer of personal data. References: : CDPSE Review Manual (Digital Version), page 107

The proportionality of the data collected for the intended purpose is the most important privacy consideration when developing a contact tracing application. This means that the application should only collect the minimum amount of personal data necessary to achieve the specific and legitimate purpose of preventing and controlling the spread of COVID-191. The application should also ensure that the data collected are relevant, adequate, and not excessive in relation to the purpose2. The application should avoid collecting or processing any data that are not essential for the purpose, such as location data, biometric data, or health data unrelated to COVID-193. The application should also respect the data minimization principle, which requires that the data are kept for no longer than necessary for the purpose4. References:

European Data Protection Board Guidelines 04/2020 on the use of location data and contact tracing tools in the context of the COVID-19 outbreak

Article 5(1)© of the General Data Protection Regulation (GDPR)

Article 29 Data Protection Working Party Opinion 04/2017 on the Proposed Regulation for the ePrivacy Regulation

Article 5(1)(e) of the GDPR

After a privacy risk has been accepted, the next step is to monitor the risk landscape for material changes. This means that the organization should keep track of any internal or external factors that may affect the likelihood or impact of the risk, such as new threats, vulnerabilities, regulations, technologies, or business processes. Monitoring the risk landscape can help the organization identify if the risk acceptance decision is still valid, or if it needs to be revisited or revised. Monitoring can also help the organization prepare for potential incidents or consequences that may arise from the accepted risk.

The best way to validate compliance with agreed-upon service levels established with a third party that processes personal data is to have a contractual right to audit, which means that the organization can conduct audits or inspections of the third party’s privacy practices, policies, and procedures to verify that they meet the contractual obligations and expectations. A contractual right to audit can also help identify and address any privacy risks or gaps that may arise from the third party’s processing of personal data12.

Data flows are the most important to review before using an application programming interface (API) to help mitigate related privacy risk. Data flows are the paths or routes that data take from their sources to their destinations through various processes, transformations, or exchanges. Data flows can help understand how data are collected, used, shared, stored, or deleted by an API and its related applications. Data flows can also help identify the potential privacy risks or impacts that may arise from data processing activities involving an API and its related applications. Data flows can be represented by diagrams, maps, models, or documents that show the sources, destinations, types, formats, volumes, frequencies, purposes, or legal bases of data.

Data taxonomy, data classification, and data collection are also important for privacy risk mitigation when using an API, but they are not the most important. Data taxonomy is a system of organizing and categorizing data into groups, classes, or hierarchies based on their characteristics, attributes, or relationships. Data taxonomy can help understand the structure, meaning, context, or value of data. Data classification is a process of assigning labels or tags to data based on their sensitivity, confidentiality, criticality, or risk level. Data classification can help determine the appropriate level of protection or handling for data. Data collection is a process of gathering or obtaining data from various sources for a specific purpose or objective. Data collection can help obtain the necessary information or evidence for decision making or problem solving.

Data masking is the process of hiding original data with modified content to protect sensitive data from unauthorized access or disclosure. Data masking is often used for testing purposes in non-production environments, where personal data is not needed or allowed. However, data masking can pose several challenges, especially for a global financial institution that has multiple interconnected systems and applications. One of the greatest challenges is to preserve the complex relationships within and across systems while masking the data. This means that the masked data must maintain the same format, referential integrity, semantic integrity, and uniqueness as the original data, so that the testing results are valid and reliable. For example, if a customer’s name is masked in one system, it must be masked consistently in all other systems that reference it. If a transaction amount is masked in one system, it must not violate any business rules or constraints in another system. If a credit card number is masked in one system, it must still be a valid credit card number in another system. Preserving these complex relationships can be challenging because it requires a thorough understanding of the data model, the business logic, and the dependencies among systems. It also requires a robust and flexible data masking tool that can handle different types of data and platforms.

The first thing that an IT privacy practitioner should do before an organization migrates personal data from an on-premise solution to a cloud-hosted solution is to perform a privacy impact assessment (PIA). A PIA is a systematic process of identifying and evaluating the potential privacy risks and impacts of a data processing activity or system. A PIA helps to ensure that privacy is considered and integrated into the design and development of data processing activities or systems, and that privacy risks are mitigated or eliminated. A PIA also helps to determine the appropriate measures to protect personal data in a cloud-hosted solution, such as encryption, pseudonymization, anonymization, access control, audit trail, breach notification, etc. A PIA also helps to comply with the applicable privacy regulations and standards that govern data processing activities in a cloud-hosted solution. References: : CDPSE Review Manual (Digital Version), page 99

Pseudonymization is a technique that replaces or removes direct identifiers from personal data, such as names, addresses, or social security numbers, with pseudonyms, such as codes, tokens, or random values. However, pseudonymization does not eliminate the possibility of re-identification, as the original data can still be linked back to the pseudonyms using additional information or techniques. Therefore, if a database containing pseudonymized personal data is breached, the IT privacy practitioner should be most concerned about the risk of re-identification, which could compromise the privacy and security of the data subjects. The other options are less relevant or important than the risk of re-identification.

A privacy impact assessment (PIA) is a systematic process to identify and evaluate the potential privacy impacts of a system, project, program or initiative that involves the collection, use, disclosure or retention of personal data. A PIA should be done first when planning a new implementation for tracking consumer web browser activity, as it would help to ensure that privacy risks are identified and mitigated before the implementation is executed. A PIA would also help to ensure compliance with privacy principles, laws and regulations, and alignment with consumer expectations and preferences. The other options are not as important as conducting a PIA when planning a new implementation for tracking consumer web browser activity. Seeking approval from regulatory authorities may be required or advisable for some types of personal data or data processing activities, but it may not be necessary or sufficient for tracking consumer web browser activity, depending on the context and jurisdiction. Obtaining consent from the organization’s clients may be required or advisable for some types of personal data or data processing activities, but it may not be necessary or sufficient for tracking consumer web browser activity, depending on the context and jurisdiction. Reviewing and updating the cookie policy may be required or advisable for some types of personal data or data processing activities, but it may not be necessary or sufficient for tracking consumer web browser activity, depending on the context and jurisdiction1, p. 67 References: 1: CDPSE Review Manual (Digital Version)

D. Requiring employees to review the organization’s privacy policy on an annual basis

Short Explanation: Requiring employees to review the organization’s privacy policy on an annual basis is the best activity to enable an organization to identify gaps in its privacy posture because it can help to ensure that the employees are aware of the current privacy requirements, expectations, and practices of the organization. It can also help to identify any discrepancies, inconsistencies, or conflicts between the policy and the actual implementation of privacy controls and processes. By reviewing the policy regularly, the organization can also update and improve it as needed to reflect any changes in the privacy landscape, such as new laws, regulations, standards, or threats.

A virtual private network (VPN) is a technology that creates a secure and encrypted connection over a public network, such as the internet. A VPN should be established first before authorizing remote access to a data store containing personal data, as it protects the data from unauthorized interception, modification, or disclosure by third parties. A VPN also helps to ensure the identity and authenticity of the remote users and devices accessing the data store. References: 2 Domain 2, Task 8

The primary purpose of a privacy audit framework is to confirm and demonstrate effectiveness of the privacy program in achieving objectives and regulatory compliance. Historical breaches (B) and benchmarking (D) are by-products; maximizing staff effort (C) is about audit efficiency, not program assurance.

“Privacy audits validate the effectiveness and compliance of the privacy program.”

A third-party privacy control assessment is an independent and objective evaluation of the design and effectiveness of the privacy controls implemented by an organization to protect personal data and comply with privacy laws and regulations. A third-party privacy control assessment can help senior management to verify the success of its commitment to privacy by design, by providing the following benefits:

It can measure the extent to which the organization has adopted and integrated the principles and practices of privacy by design throughout its products, services, processes and systems.

It can identify the strengths and weaknesses of the organization’s privacy governance, policies, procedures, standards and guidelines, and provide recommendations for improvement.

It can validate the organization’s compliance with the applicable privacy requirements and expectations of its customers, stakeholders, regulators and auditors.

It can enhance the organization’s reputation and trustworthiness as a responsible and transparent data controller and processor.

The other options are less effective or irrelevant for verifying the success of the commitment to privacy by design. Reviewing the findings of an industry benchmarking assessment may provide some insights into how the organization compares with its peers or competitors in terms of privacy performance, but it may not reflect the specific privacy goals, risks and challenges of the organization. Identifying trends in the organization’s amount of compromised personal data or number of privacy incidents may indicate some aspects of the organization’s privacy maturity, but they are reactive and lagging indicators that do not capture the proactive and preventive nature of privacy by design. Moreover, these metrics may not account for other factors that may influence the occurrence or impact of data breaches or privacy violations, such as external threats, human errors or environmental changes.

A private cloud is a cloud deployment model that provides exclusive access and control to a single organization or a specific group of users within the organization. A private cloud is best for an organization whose main objectives are to logically isolate personal data from other tenants and adopt custom privacy controls for the data, as it offers the highest level of security, privacy, and customization among the cloud deployment models. A private cloud allows the organization to implement its own privacy policies, standards, and procedures for the personal data, as well as to configure the cloud infrastructure, services, and applications according to its specific needs and preferences. A private cloud also reduces the risk of data breaches, unauthorized access, or co-mingling of data from other tenants, as the personal data is stored and processed in a dedicated and isolated environment.

The best indication of a highly effective privacy training program is that members of the workforce understand their roles in protecting data privacy, because this shows that the training program has successfully raised the awareness and knowledge of the workforce on the importance, principles and practices of data privacy, and how they can contribute to the organization’s privacy objectives and compliance. According to ISACA, one of the key elements of a privacy training program is to define and communicate the roles and responsibilities of the workforce in relation to data privacy1. Members of the workforce who understand their roles in protecting data privacy are more likely to follow the privacy policies and procedures, report any privacy incidents or issues, and support the privacy culture of the organization2. Recent audits have no findings or recommendations related to data privacy, no privacy incidents have been reported in the last year, and HR has made privacy training an annual mandate for the organization are not as reliable as members of the workforce understand their roles in protecting data privacy, as they do not necessarily reflect the effectiveness of the privacy training program, but rather the performance of other factors such as audit processes, incident management systems, or HR policies.

Inferred data is the type of data that is produced by using a more complex method of analytics to find correlations between data sets and using them to categorize or profile people. Inferred data is not directly observed or collected from the data subjects, but rather derived from other sources of data, such as behavioral, transactional, or demographic data. Inferred data can be used to make assumptions or predictions about the data subjects’ preferences, interests, behaviors, or characteristics12.

Classifying sensitive unstructured data should be done first to address the situation of the proliferation of personal data held as unstructured data, as it helps to identify the types, locations, and owners of the data, and to apply the appropriate privacy controls and measures based on the data classification level. Classifying sensitive unstructured data also facilitates the data discovery, data minimization, data retention, and data disposal processes. References: 2 Domain 3, Task 2; 5 Page 9

When contracting with a SaaS provider, it is important to ensure that the provider will remove all customer data from their systems and storage devices at the end of the service contract. This will prevent any unauthorized access, use, or disclosure of the customer data by the provider or third parties after the service termination. Removal of customer data means that the data are permanently erased and cannot be recovered or restored by any means.

The primary reason that a single cryptographic key should be used for only one purpose, such as encryption or authentication, is that it minimizes the risk if the cryptographic key is compromised. A cryptographic key is a piece of information that is used to perform cryptographic operations, such as encryption or authentication. Encryption is a process of transforming data into an unreadable form using a secret key or algorithm. Authentication is a process of verifying the identity or integrity of a user or data using a secret key or algorithm. If a single cryptographic key is used for multiple purposes, such as encryption and authentication, it increases the risk if the cryptographic key is compromised. For example, if an attacker obtains the cryptographic key that is used for both encryption and authentication, they can decrypt and access personal data, as well as impersonate or modify legitimate users or data. Therefore, a single cryptographic key should be used for only one purpose, and different keys should be used for different purposes. References: : CDPSE Review Manual (Digital Version), page 107

The best answer is D. Mutual certificate authentication.

A comprehensive explanation is:

Mutual certificate authentication is a method of mutual authentication that uses public key certificates to verify the identities of both parties in a two-way communication. A public key certificate is a digital document that contains information about the identity of the certificate holder, such as their name, organization, domain name, etc., as well as their public key, which is used for encryption and digital signature. A public key certificate is issued and signed by a trusted authority, called a certificate authority (CA), that vouches for the validity of the certificate.

Mutual certificate authentication works as follows:

Both parties have a public key certificate issued by a CA that they trust.

When they initiate a communication, they exchange their certificates with each other.

They verify the signatures on the certificates using the CA’s public key, which they already have or can obtain from a trusted source.

They check that the certificates are not expired, revoked, or tampered with.

They extract the public keys from the certificates and use them to encrypt and decrypt messages or to generate and verify digital signatures.

They confirm that the identities in the certificates match their expectations and intentions.

By using mutual certificate authentication, both parties can be confident that they are communicating with the intended and legitimate party, and that their communication is secure and confidential.

Mutual certificate authentication is often used in conjunction with Transport Layer Security (TLS), a protocol that provides encryption and authentication for network communications. TLS supports both one-way and two-way authentication. In one-way authentication, only the server presents a certificate to the client, and the client verifies it. In two-way authentication, also known as mutual TLS or mTLS, both the server and the client present certificates to each other, and they both verify them. Mutual TLS is commonly used for secure web services, such as APIs or webhooks, that require both parties to authenticate each other.

Virtual private network (VPN), Secure Shell (SSH), and Transport Layer Security (TLS) are all technologies that can help to ensure the identities of individuals in a two-way communication are verified, but they are not methods of mutual authentication by themselves. They can use mutual certificate authentication as one of their options, but they can also use other methods, such as username and password, pre-shared keys, or tokens. Therefore, they are not as specific or accurate as mutual certificate authentication.

A privacy impact assessment (PIA) is a systematic process of identifying and evaluating the potential privacy risks and impacts of a data processing activity or system. A PIA helps to ensure that privacy is considered and integrated into the design and development of data processing activities or systems, and that privacy risks are mitigated or eliminated. A PIA also helps to determine the appropriate retention periods for personal data based on the purpose and necessity of the data processing, as well as the legal and regulatory obligations that apply to the data. Therefore, a PIA helps to define data retention time in a stream-fed data lake that includes personal data. References: : CDPSE Review Manual (Digital Version), page 99

The data owner is the person or entity who has the ultimate authority and responsibility for the protection of personal data collected by an organization. The data owner defines the purpose, scope, classification, and retention of the personal data, as well as the rights and obligations of the data subjects and other parties involved in the data processing. The data owner also ensures that the personal data is handled in compliance with the applicable privacy laws and regulations, as well as the organization’s privacy policies and standards. The data owner may delegate some of the operational tasks to the data processor, data custodian, or data protection officer, but the accountability remains with the data owner.

A data processor that handles personal data for multiple customers has decided to migrate its data warehouse to a third-party provider. The processor is obligated to seek approval from all in-scope data controllers prior to implementation. A data controller is an entity that determines the purposes and means of processing personal data. A data processor is an entity that processes personal data on behalf of a data controller. A third-party provider is an entity that provides services or resources to another entity, such as a cloud service provider or a hosting provider.

According to various privacy laws and regulations, such as the GDPR or the CCPA, a data processor must obtain explicit consent from the data controller before engaging another processor or transferring personal data to a third country or an international organization. The consent must specify the identity of the other processor or the third country or international organization, as well as the safeguards and guarantees for the protection of personal data. The consent must also be documented in a written contract or other legal act that binds the processor to respect the same obligations as the controller.

Seeking approval from all in-scope data controllers can help ensure that the processor complies with its contractual and legal obligations, respects the rights and preferences of the data subjects, and maintains transparency and accountability for its processing activities.

Obtaining assurance that data subject requests will continue to be handled appropriately, implementing comparable industry-standard data encryption in the new data warehouse, or ensuring data retention periods are documented are also good practices for a data processor that migrates its data warehouse to a third-party provider, but they are not obligations prior to implementation. Rather, they are requirements or recommendations during or after implementation.

Obtaining assurance that data subject requests will continue to be handled appropriately is a requirement for a data processor that processes personal data on behalf of a data controller. Data subject requests are requests made by individuals to exercise their rights regarding their personal data, such as access, rectification, erasure, restriction, portability, or objection. A data processor must assist the data controller in fulfilling these requests within a reasonable time frame and without undue delay.

Implementing comparable industry-standard data encryption in the new data warehouse is a recommendation for a data processor that transfers personal data to another system or location. Data encryption is a process of transforming data into an unreadable form using a secret key or algorithm. Data encryption can help protect the confidentiality, integrity, and availability of personal data by preventing unauthorized access, disclosure, or modification.

Ensuring data retention periods are documented is a requirement for a data processor that stores personal data on behalf of a data controller. Data retention periods are the durations for which personal data are kept before they are deleted or anonymized. Data retention periods must be determined by the purpose and necessity of processing personal data and must comply with legal and regulatory obligations.

Before de-identifying data, it is important to determine the categories of personal data collected, such as names, addresses, phone numbers, email addresses, social security numbers, health information, and so on. This will help to identify which data elements are considered identifiers or quasi-identifiers, and which de-identification techniques are appropriate for each category. For example, some data elements may need to be removed completely, while others may be masked, generalized, or perturbed.

The best reason for a health organization to use desktop virtualization to implement stronger access control to systems containing patient records is that it can improve data integrity and reduce effort for privacy audits. Desktop virtualization is a technology that allows users to access a virtual desktop environment that is hosted on a remote server, rather than on their local device. Desktop virtualization can enhance data privacy by providing stronger access control to systems containing patient records, such as requiring authentication, authorization, encryption, logging, etc. Desktop virtualization can also improve data integrity by ensuring that patient records are stored and processed in a centralized and secure location, rather than on multiple devices that may be vulnerable to loss, theft, damage, or corruption. Desktop virtualization can also reduce effort for privacy audits by simplifying the management and monitoring of data privacy compliance across different devices and locations. References: : CDPSE Review Manual (Digital Version), page 153

A privacy impact assessment (PIA) is a process of analyzing the potential privacy risks and impacts of collecting, using, and disclosing personal data. A PIA should be conducted when there is a change in the data processing activities that may affect the privacy of individuals or the compliance with data protection laws and regulations. One of the scenarios that should trigger the completion of a PIA is when there are new inter-organizational data flows, which means that personal data is shared or transferred between different entities or jurisdictions. This may introduce new privacy risks, such as unauthorized access, misuse, or breach of data, as well as new legal obligations, such as obtaining consent, ensuring adequate safeguards, or notifying authorities.

The best approach for a local office of a global organization faced with multiple privacy-related compliance requirements is to focus on the requirements with the highest organizational impact, because this will help prioritize the most critical and urgent privacy issues and risks that may affect the organization’s reputation, operations, or legal obligations. Focusing on the highest impact requirements will also help allocate the resources and efforts more efficiently and effectively, as well as align the local office’s privacy practices with the global organization’s objectives and strategies12.

The best way to address privacy concerns when an organization captures personal data from a third party through an open application programming interface (API) is to obtain consent from the data subjects. Consent is a freely given, specific, informed, and unambiguous indication of the data subject’s wishes by which they agree to the processing of their personal data by the organization for a defined purpose. Consent is one of the legal bases for processing personal data under various privacy laws and regulations such as the General Data Protection Regulation (GDPR) or the California Consumer Privacy Act (CCPA). Obtaining consent from the data subjects can help ensure that they are aware of and agree to the collection and use of their personal data by the organization through the open API. Obtaining consent can also help respect the data subject’s rights and preferences regarding their personal data.

Developing a service level agreement (SLA) with the third party, implementing encryption for the data transmission, or reviewing the specification document of the open API are also good practices for addressing privacy concerns when using an open API to capture personal data from a third party, but they are not the best way. Developing an SLA with the third party can help define the roles, responsibilities, expectations, and obligations of both parties regarding the provision and use of the open API and the personal data involved. Implementing encryption for the data transmission can help protect the confidentiality, integrity, and availability of the personal data transferred between the third party and the organization through the open API. Reviewing the specification document of the open API can help understand the functionality, features, parameters, or requirements of the open API and how it handles personal data.

Prioritizing privacy-related risk scenarios as part of ERM processes is the best way to ensure that the risk responses meet the organizational objectives, because it helps to align the privacy risk management with the overall strategic goals, values, and culture of the organization. ERM is a holistic approach to identify, assess, and manage risks across the organization, taking into account the interdependencies and trade-offs among different types of risks. By integrating privacy-related risk scenarios into the ERM processes, the organization can evaluate the potential impact and likelihood of privacy risks on its mission, vision, and performance, and prioritize the most significant ones for mitigation or acceptance. This can also help to allocate appropriate resources, assign clear roles and responsibilities, and monitor and report on the effectiveness of the risk responses.

Height, weight, and activities are the most legitimate information to collect for business reasons in this situation, as they are directly related to the purpose and functionality of a wellness smartwatch application that aims to monitor and improve the health and fitness of its users. Collecting height, weight, and activities would also comply with the data minimization principle that requires limiting the collection, storage and processing of personal data to what is necessary and relevant for the intended purposes. The other options are not legitimate information to collect for business reasons in this situation, as they are not related to the purpose and functionality of a wellness smartwatch application and may violate the privacy rights and preferences of its users. Collecting sleep schedule and calorie intake may be useful for some users who want to track their sleep quality and nutrition intake, but they are not essential for a wellness smartwatch application and may require additional consent or justification from the users. Collecting education and profession may be irrelevant for a wellness smartwatch application and may be used for other purposes, such as marketing or profiling, without the consent or knowledge of the users. Collecting race, age, and gender may be sensitive for some users who do not want to disclose their personal characteristics or identity, and may require additional safeguards or measures to protect their privacy1, p. 75-76 References: 1: CDPSE Review Manual (Digital Version)

Input validation controls are the best way to ensure consumer credit card numbers are accurately captured. Input validation controls are methods that check the format, type, range, and length of the input data before accepting, processing, or storing it. Input validation controls can help prevent errors, fraud, or data loss by rejecting invalid, incomplete, or malicious input. For example, input validation controls can verify that a credit card number follows the Luhn algorithm1, has the correct number of digits2, and matches the card issuer’s prefix3. Input validation controls can also prevent SQL injection attacks4 or cross-site scripting attacks5 that may compromise the security and privacy of the data.

Input reference controls, access controls, and reconciliation controls are also important for data quality and security, but they do not directly ensure the accuracy of consumer credit card numbers. Input reference controls are methods that compare the input data with a predefined list of values or a reference table to ensure consistency and validity. For example, input reference controls can check if a country name or a postal code is valid by looking up a database of valid values. Access controls are methods that restrict who can access, modify, or delete the data based on their roles, permissions, or credentials. For example, access controls can prevent unauthorized users from accessing or tampering with consumer credit card numbers. Reconciliation controls are methods that compare the data from different sources or systems to ensure completeness and accuracy. For example, reconciliation controls can check if the transactions recorded in the accounting system match the transactions processed by the payment gateway.