Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Data privacy and protection > chapter 5 > Flashcards

chapter 5 Flashcards

1
Q

what is data Protection Management Programme

A

–> builds a strong foundation for data protection within the organisation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

DPMP FULL FORM

A

data Protection Management Programme

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

what are DPMP SECTIONS

A

governance and risk assessment

policy and practices

processes

maintenance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

what is the purpose of the DPMP

A

–> Helps organizations demonstrate accountability in data protection

–> Stakeholders and Regulators: Ensures compliance with data protection regulations and addresses the concerns of stakeholders and regulatory bodies

–> Customers and Business Partners: Builds trust and confidence by safeguarding personal data and respecting privacy rights

–> Business Competitiveness: Enhances competitive advantage by demonstrating a strong commitment to data protection and establishing a positive brand image

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

what are the 2 aspects in governance and risk assessment

A

Governance Structure

Values Risk Assessment

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

what is the role of Senior Management

A
  1. Defining corporate values that are aligned with data
    protection
  2. Allocating resources to data protection
  3. Appointing a Data Protection Officer (DPO)
  4. Managing personal data protection risks
  5. Providing guidance on data protection initiatives
  6. Supporting data protection policies and programme
  7. Commissioning Data Protection Impact Assessments
  8. Advocating data protection training
  9. Providing directions to the DPO
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

what is the role of data protection officer

A

Implementing policies and processes for handling personal data

Fostering a data protection awareness and culture

Managing personal data protection

Communicating to management of any data protection
related risks

Liaising with the PDPC

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

it is __________ to appoint a data protection officer in singapore

A

compulsory

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

who does the DPO report to ?

A

chief internal audit

chief legal officer

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

The DPO operations may be outsourced to a service provider, however the DPO responsibility remains with _____________

A

a member of the senior management

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

what is data protection as a service

A

when the DPO operations are outsourced to a service provider

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Protecting personal data is the responsibility of
______

A

everyone in the organization

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

what is the Culture of Accountability and Staff Training

A
  1. Personal data protection education for all staff, from Board to Senior Management to Staff
  2. Trainings and briefings on personal data protection should be tailored to job functions
  3. Regular staff communication circulars to include personal data protection topics
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

what should the senior management have an understanding of ?

A

Senior management should have an understanding of risks and review how risks affects the organisation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

what are the 4 types of risks

A

Strategic
*Affects achieving company strategic objectives
*e.g. governance, strategic planning

Operational
*Affects organisational operations
*e.g. sales and marketing, production

Compliance
*Affects organisational compliance with regulations
*e.g. legal, code of conduct

Financial
*Affects organisational financial process
*e.g. reporting, tax

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

To manage risks, senior management should ensure that data protection is incorporated into their___________

A

Risk Management framework

17
Q

what are the 3 things needed for corporate governance

A

policies

practices

communication

18
Q

what are the 2 data privacy policies

A

To comply to Personal Data Privacy regulations

To set expectations for individuals

19
Q

what are the Policies that needs to be explained

A

What data is collected

Why the data is being collected

What do you plan to do with the data

Contact details for any questions or concern

20
Q

what are the Policies that needs to be understood

A

Use plain language
Frequently Ask Questions
Structured for the user
Easily accessible

21
Q

what is Data Protection by Design

A

Practicing personal data protection throughout the project’s operational life cycle

22
Q

benefits of Data Protection by Design

A

Identifies personal data protection issues early

Increases personal data protection awareness

Complies with PDPA obligations

23
Q

what is Data Privacy Communication

A

Organisations should ensure that personal data protection policies are communicated clearly and upfront

24
Q

different ways of communication

A

Notification
*Publish policies and other information in simple language
*Use relevant channels (e.g. websites) that are easily accessible

Consent
*Ensure that users understand what they are consenting
*simple and clear consent clauses at appropriate touchpoints

Policy Updates
*Communicate any policy or service updates
*Communicate separately from other marketing messages

Interaction with Users
*Ensure staff interacting with users are trained in policy content
*Ensure staff sensitivity in handling data privacy feedback and queries

Access, Correction, and Complaint Handling
*Provide accessible channels for users requests
*Ensure proper processes and prompt response

25
Q

what are the 3 processes

A

Risk Identification and Mapping

Risk Remediation and Controls

Risk Reporting and Breach Management

26
Q

what are Risk Remediation and Controls

A

To implement of systems-based or process controls

27
Q

what are Risk Identification and Mapping

A

To identify and map risks relating to personal data

28
Q

what are Risk Reporting and Breach Management

A

To monitor and report occurrence of risks and breach To implement of systems-based or process controls

29
Q

what are the 3 tools used for identifying and mapping risks

A

–> Data Inventory Map – cataloguing personal data that
includes, collection, use, disclosure, storage, disposal

–> Data Flow Diagram – depicts the movement of that
data through internal systems and external transfers

–> Risk Register – records risks associated with the
personal data and how it is used, likelihood and
consequences of risk occurring

30
Q

what are 5 Risk Remediation and Control

A
  • Identify where personal data is stored
  • Determine level of security controls required
  • Apply controls on systems/infrastructure that stores
    personal data
  • Implement process controls to approve, review and
    manage access rights
  • Build data protection measures during the software
    development lifecycle
31
Q

how can you manage a data breach (Risk Reporting and Breach Managemen)

A

To manage breach by
* Containing the breach
* Assess the risk
* Reporting the incident
* Evaluating appropriate response and recover procedures

32
Q

what are the 3 steps in monitoring

A

review

audit

monitor

33
Q

what happens in Reviewing Policies and Practices

A

Changes in environment may require revisions to
data protection policies and processes.

Organisations will have to decide whether the reviews
should be applied immediately or periodically

34
Q

when should the immediate reviews happen

A

Major data leakage incident

Legislative or regulatory amendments

Organisational changes

35
Q

what are the periodic changes

A

Revision of data protection policies and
processes at regular intervals

Batch review of occurrences of minor
incidents

36
Q

how should organisations conduct an audit monitor

A

Organisations can conduct an audit monitor and
evaluate the overall implementation of their data
protection policies and processes

This could be done by
* An internal audit on a periodic basis
* An ad-hoc inspection or walk-through
* Obtaining and maintaining certifications for the
organisation’s data protection measures

37
Q

what should a organization do to monitor changes

A

Organisations need to keep up to date with
changes and developments within and outside
the organisation

38
Q

what does the external monitoring environment include

A

Amendments to regulations

Data best practices or data incidents in
other organisations

Technological changes or emerging
technologies

39
Q

what does the internal monitoring environment include

A

New or updated systems or processes

New business model

Data incidents or feedback/complaint

Data privacy and protection (7 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions