Question 1

Privacy governance practices ensure that all personal information within the enterprise

Accepted Answer

is identified and managed in accordance with legal requirements for personal information use and protection, governing policies, procedures and guidelines, and data subject rights.

Question 2

Privacy governance includes the areas of

Accepted Answer

(1) privacy management and (2) risk management.

Question 3

Privacy management practice areas include:

Accepted Answer

(1) establishing privacy roles and responsibilities related to data; (2) fostering privacy training, and awareness communications and activities; (3) monitoring vendor and third-party management practices; (4) developing a privacy audit process; (5) and implementing a privacy incident management capability.

Question 4

Privacy risk management practices should include:

Accepted Answer

(1) establishing a privacy risk management process, (2) performing privacy impact assessments (PIAs), and (3) identifying privacy threats, attacks and vulnerabilities.

Question 5

List the 5 Areas of Privacy Governance

Accepted Answer

(1) Personal Data and Information (2) Privacy Laws and Standards (3) Privacy Documentation (4) Legal Purpose, Content and Legitimate Interest (5) Data Subject Rights

Question 6

List the 5 Area of Privacy Management

Accepted Answer

(1) Roles and Responsibilities Related to Data (2) Privacy Training and Awareness (3) Vendor and Third-Party Management (4) Audit Process (5) Privacy Incident Management

Question 7

What are the 3 Ares of Privacy Risk Management?

Accepted Answer

(1) The Privacy Risk Management Process (2) Privacy Impact Assessments (3) Mitigation and Management of Threats, Attacks and Vulnerabilities Related to Privacy

Question 8

A data privacy engineer/practitioner should be able to:

Accepted Answer

(1) Identify the internal and external requirements for the organization’s privacy programs and practices. (2) Participate in the evaluation of privacy policies, programs and policies for their alignment with legal requirements, regulatory requirements and industry best practices. (3) Coordinate and perform privacy impact assessments (PIAs) and other privacy-focused assessments. (4) Participate in developing procedures that align with privacy policies and business needs. (5) Implement procedures that align with privacy policies. (6) Participate in the management and evaluation of contracts, service level agreements, and practices of vendors and other external parties. (7) Participate in the privacy incident management process. (8) Collaborate with cybersecurity personnel on the security risk assessment process to address privacy compliance and risk mitigation. (9) Collaborate with other practitioners to ensure that privacy programs and practices are followed during the design, development and implementation of systems applications and infrastructure. (10) Evaluate the enterprise architecture and information architecture to ensure support for privacy by design principles and considerations. (11) Evaluate advancements in privacy-enhancing technologies and changes in the regulatory landscape. Identify, validate and implement appropriate privacy and security controls according to data classification procedures. (12) Design, implement, and monitor processes and procedures to keep inventory and data flow records current. (13) Develop and implement a prioritization process for privacy practices. (14) Develop, monitor and report performance metrics and trends related to privacy practices. (15)Report on the status and outcomes of privacy programs and practices to relevant stakeholders. (16) Participate in privacy training and promote awareness of privacy practices. (17) Identify issues requiring remediation and opportunities for process improvement.,

Question 9

Enterprises must consider, implement and support appropriate controls to protect and manage an individual’s privacy throughout the full life cycle of personal and associated sensitive information. To accomplish this, enterprises need to

Accepted Answer

determine the internal and external requirements for the enterprise’s privacy programs and practices.

Question 10

Enterprises should establish and implement an

Accepted Answer

executive-supported privacy risk management strategy.

Question 11

This strategy should:

Accepted Answer

(1) Consider privacy risk during the design phase of the enterprise’s business processes, applications and systems. (2) Identify and implement mitigating controls for risks to the privacy and security of personal and sensitive information. (3) Inventory the circumstances in which data are processed. (4) Understand the privacy interests of individuals directly or indirectly served or affected by an enterprise. (5) Conduct risk assessments for an enterprise to understand its business environment, and to identify and prioritize privacy risks.

Question 12

When planning a privacy risk strategy, a useful resource is the

Accepted Answer

National Institute for Standards and Technology (NIST) Privacy Framework.

Question 13

After the initial implementation of the privacy program, enterprises need to

Accepted Answer

identify the additional necessary controls, as applicable, throughout the entire development and implementation life cycle.

Question 14

Finally, privacy _____ and _______ should be included in project budgets so that the costs are associated with the privacy controls.

Accepted Answer

costs resources

Question 15

Per the _______ ________ Framework, enterprises should develop and implement their governance structure based on the enterprise’s risk management priorities to minimize privacy risk.

Accepted Answer

NIST Privacy

CDPSE Domain 1: Privacy Governance Flashcards

1. Personal Data and Information 2. Privacy Laws and Standards 3. Privacy Documentation 4. Legal Purpose, Content and Legitimate Interest 5. Data Subject Rights

Brainscape's Knowledge GenomeTM

CDPSE Domain 1: Privacy Governance Flashcards

1. Personal Data and Information 2. Privacy Laws and Standards 3. Privacy Documentation 4. Legal Purpose, Content and Legitimate Interest 5. Data Subject Rights

Brainscape's Knowledge Genome^TM