CDPSE Certified Data Privacy Solutions Engineer Questions and Answers

The best time during the secure development life cycle to perform privacy threat modeling is early in the design phase, because this will help identify and mitigate the potential privacy risks and vulnerabilities of the system or application before they become costly or difficult to fix. Privacy threat modeling is a systematic process of analyzing the data flows, assets, actors, and scenarios of a system or application to identify and prioritize the privacy threats and countermeasures12. Performing privacy threat modeling early in the design phase will also help ensure that privacy is built into the system or application from the start, rather than as an afterthought.

References:

• CDPSE Exam Content Outline, Domain 2 – Privacy Architecture (Privacy Architecture Implementation), Task 2: Implement privacy solutions3.
• CDPSE Review Manual, Chapter 2 – Privacy Architecture, Section 2.3 – Privacy Architecture Implementation4.

A retention schedule is a document that specifies how long different types of records or data should be kept and when they should be deleted or disposed of, based on legal, regulatory, operational or historical requirements. A retention schedule is the best indication of an effective records management program for personal data, as it reflects the principles of data minimization and storage limitation, which require limiting the collection, storage and processing of personal data to what is necessary and relevant for the intended purposes, and deleting or disposing of personal data when it is no longer needed or justified. A retention schedule also helps to reduce the privacy risks and costs associated with data storage and retention, such as data breaches, unauthorized access, misuse or loss of data. The other options are not as indicative of an effective records management program for personal data as a retention schedule. Archived data is used for future analytics may indicate that the organization is leveraging its data assets for business intelligence or research purposes, but it may not comply with the principles of data minimization and storage limitation, or the privacy rights and preferences of the data subjects. The legal department has approved the retention policy may indicate that the organization has obtained legal advice or guidance on its records management program for personal data, but it may not reflect the actual implementation or execution of the retention policy. All sensitive data has been tagged may indicate that the organization has implemented a data classification scheme for its records or data, but it may not indicate how long the records or data should be kept or when they should be deleted or disposed of1, p. 99-100 References: 1: CDPSE Review Manual (Digital Version)

Following an established privacy framework is the most important step when developing an organizational data privacy program because it provides a structured and consistent approach to identify, assess, and manage privacy risks and compliance obligations. A privacy framework can also help to align the privacy program with the organization’s strategic goals, values, and culture, as well as to communicate and demonstrate the privacy program’s effectiveness to internal and external stakeholders. Some examples of established privacy frameworks are the NIST Privacy Framework, the ISO/IEC 27701:2019, and the AICPA Privacy Maturity Model.

References:

• NIST Privacy Framework: A Tool for Improving Privacy through Enterprise Risk Management, NIST
• ISO/IEC 27701:2019 Security techniques — Extension to ISO/IEC 27001 and ISO/IEC 27002 for privacy information management — Requirements and guidelines, ISO
• Privacy Maturity Model, AICPA

Transport Layer Security (TLS) is a protocol that provides secure communication over the internet by encrypting and authenticating data. TLS provides data integrity through the calculation of message digests, which are cryptographic hashes that summarize the content and structure of a message. The sender and the receiver of a message can compare the message digests to verify that the message has not been altered or corrupted during transmission. TLS also uses digital certificates, asymmetric encryption, and symmetric encryption to provide confidentiality and authentication, but these are not directly related to data integrity.

References: CDPSE Review Manual, 2021, p. 117

The best way for an organization to maintain the effectiveness of its privacy breach incident response plan is to conduct annual data privacy tabletop exercises. A data privacy tabletop exercise is a simulated scenario that tests the organization’s ability to respond to a privacy breach incident, such as a data breach, leak, or misuse. A data privacy tabletop exercise involves key stakeholders, such as the privacy office, the information security team, the legal counsel, the public relations team, etc., who role-play their actions and decisions based on the scenario. A data privacy tabletop exercise helps to evaluate and improve the organization’s privacy breach incident response plan, such as identifying gaps or weaknesses, validating roles and responsibilities, verifying procedures and protocols, assessing communication and coordination, etc. References: : CDPSE Review Manual (Digital Version), page 83

Compartmentalizing resource access is a security technique that divides a system or network into separate segments or zones with different levels of access and control, based on the sensitivity and value of the data or resources. Compartmentalizing resource access would most effectively reduce the impact of a successful breach through a remote access solution, as it would limit the scope and extent of the breach, and prevent unauthorized access to other segments or zones that contain more critical or sensitive data or resources. The other options are not as effective as compartmentalizing resource access in reducing the impact of a successful breach through a remote access solution. Regular testing of system backups is a security technique that verifies the availability and recoverability of data in case of a system failure or disaster, but it does not prevent or limit unauthorized access to data. Monitoring and reviewing remote access logs is a security technique that records and analyzes the activities and events related to remote access sessions, but it does not prevent or limit unauthorized access to data. Regular physical and remote testing of the incident response plan is a security technique that evaluates and improves the readiness and effectiveness of an organization’s response to security incidents, but it does not prevent or limit unauthorized access to data1, p. 91-92 References: 1: CDPSE Review Manual (Digital Version)

Pseudonymization is a technique that replaces direct identifiers in a data set with pseudonyms or artificial identifiers that do not reveal the identity of the data subjects. Pseudonymization reduces the linkability of the data set with the original identity of the data subjects and thus enhances the privacy and security of the data. However, pseudonymization is not irreversible and the original identity can be re-established if the pseudonym or key is compromised. Therefore, it is important to keep the identifier separate and distinct from the data it protects and to apply additional security measures to safeguard the identifier. The other options are not relevant to pseudonymization1, p. 74-75 References: 1: CDPSE Review Manual (Digital Version)

A third-party privacy control assessment is an independent and objective evaluation of the design and effectiveness of the privacy controls implemented by an organization to protect personal data and comply with privacy laws and regulations. A third-party privacy control assessment can help senior management to verify the success of its commitment to privacy by design, by providing the following benefits:

• It can measure the extent to which the organization has adopted and integrated the principles and practices of privacy by design throughout its products, services, processes and systems.
• It can identify the strengths and weaknesses of the organization’s privacy governance, policies, procedures, standards and guidelines, and provide recommendations for improvement.
• It can validate the organization’s compliance with the applicable privacy requirements and expectations of its customers, stakeholders, regulators and auditors.
• It can enhance the organization’s reputation and trustworthiness as a responsible and transparent data controller and processor.

The other options are less effective or irrelevant for verifying the success of the commitment to privacy by design. Reviewing the findings of an industry benchmarking assessment may provide some insights into how the organization compares with its peers or competitors in terms of privacy performance, but it may not reflect the specific privacy goals, risks and challenges of the organization. Identifying trends in the organization’s amount of compromised personal data or number of privacy incidents may indicate some aspects of the organization’s privacy maturity, but they are reactive and lagging indicators that do not capture the proactive and preventive nature of privacy by design. Moreover, these metrics may not account for other factors that may influence the occurrence or impact of data breaches or privacy violations, such as external threats, human errors or environmental changes.

References:

• Privacy by Design: How Far Have We Come? - ISACA, section 1: “Privacy by design challenges conventional system thinking. It mandates that any system, process or infrastructure that uses personal data consider privacy throughout its development life cycle.”
• Privacy Control Assessment - ISACA, section 1: “A Privacy Control Assessment (PCA) is an independent evaluation performed by a qualified assessor to determine whether an entity’s controls are suitably designed and operating effectively to meet its objectives related to protecting personal information.”
• Privacy by Design: The New Competitive Advantage - ISACA, section 2: “Privacy by design is a proactive approach to embedding privacy into the design specifications of various technologies, business practices and networked infrastructure.”

Any organization collecting information about EU residents is required to operate with transparency in collecting and using their personal information. Chapter III of the GDPR defines eight data subject rights that have become foundational for other privacy regulations around the world:

Right to access personal data. Data subjects can access the data collected on them.

One of the privacy requirements related to the rights of data subjects is the right to access, which means that individuals have the right to obtain a copy of their personal data, as well as information about how their data is processed, by whom, for what purposes, and for how long. To meet this requirement, an organization’s technology stack should incorporate features that allow individuals to have direct access to their data, such as self-service portals, dashboards, or applications. This way, individuals can exercise their right to access without relying on intermediaries or manual processes, which can be inefficient, error-prone, or insecure. References: : CDPSE Review Manual (Digital Version), page 137

The most effective way to support organizational privacy awareness objectives is D. Customizing awareness training by business unit function.

A comprehensive explanation is:

Organizational privacy awareness objectives are the goals and expectations that an organization sets for its employees and stakeholders regarding the protection and management of personal data. Privacy awareness objectives may vary depending on the nature, scope, and purpose of the organization’s data processing activities, as well as the legal, regulatory, contractual, and ethical obligations and implications that apply to them.

One of the best practices to support organizational privacy awareness objectives is to customize awareness training by business unit function. This means that the organization should design and deliver privacy awareness training programs that are tailored to the specific roles, responsibilities, and needs of each business unit or department within the organization. Customizing awareness training by business unit function can have several benefits, such as:

• Enhancing the relevance and effectiveness of the training content and methods for each audience group, by addressing their specific privacy challenges, risks, and opportunities.
• Increasing the engagement and motivation of the trainees, by showing them how privacy relates to their daily tasks, goals, and performance.
• Improving the retention and application of the training knowledge and skills, by providing practical examples, scenarios, and exercises that reflect the real-world situations and problems that the trainees may encounter.
• Fostering a culture of privacy across the organization, by creating a common language and understanding of privacy concepts, principles, and practices among different business units or departments.

Some examples of how to customize awareness training by business unit function are:

• Providing different levels or modules of training based on the degree of access or exposure to personal data that each business unit or department has. For example, a basic level of training for all employees, an intermediate level of training for employees who handle personal data occasionally or incidentally, and an advanced level of training for employees who handle personal data regularly or extensively.
• Providing different topics or themes of training based on the type or category of personal data that each business unit or department processes. For example, a general topic of training for employees who process non-sensitive or non-personal data, a specific topic of training for employees who process sensitive or special data categories (such as health, biometric, financial, or political data), and a specialized topic of training for employees who process high-risk or high-value data (such as intellectual property, trade secrets, or customer loyalty data).
• Providing different formats or modes of training based on the preferences or constraints of each business unit or department. For example, a face-to-face format of training for employees who work in the same location or office, an online format of training for employees who work remotely or across different time zones, and a blended format of training for employees who work in a hybrid mode or have flexible schedules.

The other options are not as effective as option D.

Funding in-depth training and awareness education for data privacy staff (A) may improve the competence and confidence of the data privacy staff who are responsible for designing and implementing the privacy policies and practices of the organization, but it does not necessarily support the organizational privacy awareness objectives for the rest of the employees and stakeholders.

Implementing an annual training certification process (B) may ensure that the employees and stakeholders are updated and refreshed on the privacy policies and practices of the organization on a regular basis, but it does not necessarily address their specific privacy needs and challenges based on their business unit function.

Including mandatory awareness training as part of performance evaluations © may incentivize the employees and stakeholders to participate in and complete the privacy awareness training programs offered by the organization, but it does not necessarily enhance their understanding and application of privacy concepts and principles based on their business unit function.

References:

• The Benefits of Information Security and Privacy Awareness Training Programs1
• What Is Your Privacy and Data Protection Strategy?2
• What is Data Privacy Awareness?3

The right not to be profiled is the right of data subjects to not be subject to a decision based solely on automated processing, including profiling, which produces legal or similarly significant effects on them. The online application that delivers a mortgage decision automatically based on criteria set by the lender is an example of such a decision, as it affects the data subject’s ability to obtain a loan.

References:

• What exactly is ‘profiling’ under the GDPR - DMA
• Can I be subject to automated individual decision-making, including profiling - European Commission

A privacy impact assessment (PIA) is a systematic process of identifying and evaluating the potential privacy risks and impacts of a data processing activity or system. A PIA helps to ensure that privacy is considered and integrated into the design and development of data processing activities or systems, and that privacy risks are mitigated or eliminated. A PIA also helps to determine the appropriate retention periods for personal data based on the purpose and necessity of the data processing, as well as the legal and regulatory obligations that apply to the data. Therefore, a PIA helps to define data retention time in a stream-fed data lake that includes personal data. References: : CDPSE Review Manual (Digital Version), page 99

Restricting access to authorized users is the best control to secure application programming interfaces (APIs) that may contain personal information, as it would prevent unauthorized access, modification or disclosure of the personal information by third parties or intermediaries. Restricting access to authorized users can be achieved by using various methods, such as authentication, authorization, encryption, tokens or certificates. The other options are not effective controls to secure APIs that may contain personal information. Encrypting APIs with the organization’s private key is not a feasible or desirable method, as it would make the APIs unreadable by anyone who does not have the corresponding public key, which would defeat the purpose of using APIs for interoperability and integration. Requiring nondisclosure agreements (NDAs) when sharing APIs is not a reliable or enforceable method, as it would depend on the compliance and cooperation of the parties who receive the APIs, and it would not prevent unauthorized access, modification or disclosure of the personal information by third parties or intermediaries who are not bound by the NDAs. Sharing only digitally signed APIs is not a sufficient method, as it would only ensure the authenticity and integrity of the APIs, but it would not prevent unauthorized access, modification or disclosure of the personal information by third parties or intermediaries who can read or intercept the APIs1, p. 90-91 References: 1: CDPSE Review Manual (Digital Version)

The scenario that poses the greatest risk to an organization from a privacy perspective is that the organization lacks a hardware disposal policy. A hardware disposal policy is a policy that defines how the organization should dispose of or destroy hardware devices that contain or process personal data, such as laptops, servers, hard drives, USBs, etc. A hardware disposal policy should ensure that personal data is securely erased or overwritten before the hardware device is discarded, recycled, donated, or sold. A hardware disposal policy should also comply with the applicable privacy regulations and standards that govern data retention and destruction. By lacking a hardware disposal policy, the organization exposes personal data to potential threats, such as theft, loss, or unauthorized access, use, disclosure, or transfer. References: : CDPSE Review Manual (Digital Version), page 123

The best indication of a highly effective privacy training program is that members of the workforce understand their roles in protecting data privacy, because this shows that the training program has successfully raised the awareness and knowledge of the workforce on the importance, principles and practices of data privacy, and how they can contribute to the organization’s privacy objectives and compliance. According to ISACA, one of the key elements of a privacy training program is to define and communicate the roles and responsibilities of the workforce in relation to data privacy1. Members of the workforce who understand their roles in protecting data privacy are more likely to follow the privacy policies and procedures, report any privacy incidents or issues, and support the privacy culture of the organization2. Recent audits have no findings or recommendations related to data privacy, no privacy incidents have been reported in the last year, and HR has made privacy training an annual mandate for the organization are not as reliable as members of the workforce understand their roles in protecting data privacy, as they do not necessarily reflect the effectiveness of the privacy training program, but rather the performance of other factors such as audit processes, incident management systems, or HR policies.

Collecting only the data necessary to meet objectives is the best approach to minimize privacy risk when collecting personal data. This is based on the principle of data minimization, which states that personal data should be adequate, relevant, and limited to what is necessary in relation to the purposes for which they are processed. Using a third party, collecting data through a secure web server, or aggregating data immediately may reduce some privacy risks, but they do not eliminate the possibility of collecting excessive or unnecessary data. References: CDPSE Exam Content Outline, Domain 3, Task 3.2

The data protection principle that is applied when an online business posts its customer data protection notice that includes a statement indicating information is collected on how products are used, the content viewed, and the time and duration of online activities is lawfulness and fairness. Lawfulness and fairness are two of the core principles of data protection under various laws and regulations, such as the GDPR or the CCPA. They state that personal data should be processed lawfully, fairly and in a transparent manner in relation to the data subject. By posting a customer data protection notice that informs customers about what information is collected and for what purpose, the online business demonstrates its compliance with these principles.

System use requirements, data integrity and confidentiality, or data use limitation are not the correct names of the data protection principles that are applied in this case. System use requirements are not a specific principle of data protection, but rather a general term that refers to the rules or policies that govern how users can access and use a system or service. Data integrity and confidentiality are two aspects of the security principle of data protection, which states that personal data should be processed in a manner that ensures appropriate security of the personal data. Data use limitation is not a specific principle of data protection either, but rather a concept that relates to the purpose limitation principle, which states that personal data should be collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes.

References: A guide to the data protection principles | ICO, Data Protection Principles: Core Principles of the GDPR - Cloudian, Data Protection Basics: The 7 data protection principles

Data privacy standards are the set of rules, guidelines, and best practices that define the requirements and expectations for the collection, processing, storage, sharing, and disposal of personal data. Data privacy standards help to ensure that personal data is treated in a fair, lawful, transparent, and secure manner, as well as to comply with the applicable privacy laws and regulations. Data privacy standards also help to define the data retention time in a stream-fed data lake that includes personal data, as they specify the criteria and conditions for how long personal data can be kept in the data lake, based on factors such as the purpose, necessity, relevance, and quality of the data. Data retention time is an important aspect of data privacy, as it affects the risk of data breaches, unauthorized access, or misuse of personal data.

References: CDPSE Review Manual, 2021, p. 80

When contracting with a SaaS provider, it is important to ensure that the provider will remove all customer data from their systems and storage devices at the end of the service contract. This will prevent any unauthorized access, use, or disclosure of the customer data by the provider or third parties after the service termination. Removal of customer data means that the data are permanently erased and cannot be recovered or restored by any means.

References:

• ISACA, Data Privacy Audit/Assurance Program, Control Objective 9: Data Disposal, p. 16-171
• ISACA, CDPSE Review Manual 2021, Chapter 4: Privacy Incident Response, Section 4.2: Data Disposal and Destruction, p. 151-152.

The best practice to protect data privacy when disposing removable backup media is B. Data sanitization.

A comprehensive explanation is:

Data sanitization is the process of permanently and irreversibly erasing or destroying the data on a storage device or media, such as a hard drive, a USB drive, a CD/DVD, etc. Data sanitization ensures that the data cannot be recovered or reconstructed by any means, even by using specialized software or hardware tools. Data sanitization is also known as data wiping, data erasure, data destruction, or data disposal.

Data sanitization is the best practice to protect data privacy when disposing removable backup media because it prevents unauthorized access, disclosure, theft, or misuse of the sensitive or confidential data that may be stored on the media. Data sanitization also helps to comply with the legal and regulatory requirements and standards for data protection and privacy, such as the General Data Protection Regulation (GDPR), the Health Insurance Portability and Accountability Act (HIPAA), the Payment Card Industry Data Security Standard (PCI DSS), etc.

There are different methods and techniques for data sanitization, depending on the type and format of the storage device or media. Some of the common methods are:

• Overwriting: Overwriting replaces the existing data on the device or media with random or meaningless data, such as zeros, ones, or patterns. Overwriting can be done multiple times to increase the level of security and assurance. Overwriting is suitable for magnetic media, such as hard disk drives (HDDs) or tapes.
• Degaussing: Degaussing exposes the device or media to a strong magnetic field that disrupts and destroys the magnetic structure and alignment of the data. Degaussing renders the device or media unusable and unreadable. Degaussing is suitable for magnetic media, such as hard disk drives (HDDs) or tapes.
• Physical Destruction: Physical destruction involves applying physical force or damage to the device or media that breaks it into small pieces or shreds it. Physical destruction can be done by using mechanical tools, such as shredders, crushers, drills, hammers, etc., or by using thermal methods, such as incineration, melting, etc. Physical destruction is suitable for any type of media, such as hard disk drives (HDDs), solid state drives (SSDs), USB drives, CDs/DVDs, etc.

Data encryption (A) is not a good practice to protect data privacy when disposing removable backup media because it does not erase or destroy the data on the media. Data encryption only transforms the data into an unreadable format that can only be accessed with a key or a password. However, if the key or password is lost, stolen, compromised, or guessed by an attacker, the data can still be decrypted and exposed. Data encryption is more suitable for protecting data in transit or at rest, but not for disposing data.

Data scrambling © is not a good practice to protect data privacy when disposing removable backup media because it does not erase or destroy the data on the media. Data scrambling only rearranges the order of the bits or bytes of the data to make it appear random or meaningless. However, if the algorithm or pattern of scrambling is known or discovered by an attacker, the data can still be unscrambled and restored. Data scrambling is more suitable for obfuscating data for testing or debugging purposes, but not for disposing data.

Data masking (D) is not a good practice to protect data privacy when disposing removable backup media because it does not erase or destroy the data on the media. Data masking only replaces some parts of the data with fictitious or anonymized values to hide its true identity or meaning. However, if the original data is still stored somewhere else or if the masking technique is weak or reversible by an attacker, the data can still be unmasked and revealed. Data masking is more suitable for protecting data in use or in analysis, but not for disposing data.

References:

• What Is Data Sanitization?1
• How to securely erase hard drives (HDDs) and solid state drives (SSDs)2
• Secure Data Disposal & Destruction: 6 Methods to Follow3

The availability of application data flow diagrams is the most significant factor that impacts an organization’s ability to respond to data subject access requests. Data subject access requests are requests made by data subjects to exercise their rights under privacy laws or regulations, such as the right to access, rectify, erase, or port their personal data. To respond to these requests effectively and efficiently, the organization needs to have a clear and accurate understanding of how personal data is collected, processed, stored, shared, and disposed of within its applications and systems. Application data flow diagrams are graphical representations of the data lifecycle that show the sources, destinations, transformations, and dependencies of the data. Having these diagrams readily available helps the organization to locate, retrieve, modify, or delete the personal data in response to the data subject access requests. The other options are less significant or relevant than the availability of application data flow diagrams, as they do not directly affect the organization’s ability to identify and access the personal data.

References: CDPSE Review Manual, 2021, p. 83

A multinational organization that operates across different countries and regions should perform an annual review of changes to privacy regulations in all jurisdictions where its corporate data is processed. This is because different jurisdictions may have different privacy laws and requirements that apply to the collection, use, storage, transfer, and disposal of personal data. For example, the EU General Data Protection Regulation (GDPR) applies to any organization that processes personal data of individuals in the EU, regardless of where the organization is located or where the data is processed. Therefore, the organization should keep track of the changes to privacy regulations in all relevant jurisdictions and update its data privacy policy accordingly to ensure compliance and avoid penalties or lawsuits.

The organization’s potential legal liabilities related to the data should be of greatest concern when an organization wants to store personal data in the cloud, as it may expose the organization to various compliance risks, such as data breach notification laws, data protection regulations, data sovereignty laws, and contractual obligations. The organization should ensure that the cloud storage provider complies with the applicable legal and regulatory requirements, and that the organization retains control and ownership of the data. The organization should also conduct due diligence and risk assessment of the cloud storage provider before entering into a contract. References: 2 Domain 2, Task 9; 4 

 Irreversible disposal is a process of removing or destroying data from a storage device or media to prevent unauthorized access or recovery of the data. Irreversible disposal is the most important thing to establish within a data storage policy to protect data privacy, as it reflects the principles of data minimization and storage limitation, which require limiting the collection, storage and processing of personal data to what is necessary and relevant for the intended purposes, and deleting or disposing of personal data when it is no longer needed or justified. Irreversible disposal also helps to reduce the privacy risks and costs associated with data storage and retention, such as data breaches, unauthorized access, misuse or loss of data. The other options are not as important as irreversible disposal in protecting data privacy within a data storage policy. Data redaction is a technique that removes or obscures sensitive or confidential information from a document or file, but it does not address the issue of data retention or deletion. Data quality assurance (QA) is a process of ensuring that the data meets the standards and specifications of accuracy, completeness, consistency and reliability, but it does not address the issue of data retention or deletion. Collection limitation is a principle that requires limiting the collection of personal data to what is necessary and relevant for the intended purposes, but it does not address the issue of data retention or deletion1, p. 75-76 References: 1: CDPSE Review Manual (Digital Version)

Lawfulness and fairness is a data protection principle that states that personal data should be processed in a lawful, fair, and transparent manner in relation to the data subject. This means that personal data should be collected and used for legitimate purposes that are specified and communicated to the data subject, and that respect the rights and interests of the data subject. By posting its customer data protection notice that includes a statement indicating information is collected on how products are used, the content viewed, and the time and duration of online activities, an online business is applying the lawfulness and fairness principle. The online business is informing the customers about the purpose and scope of data collection, and obtaining their consent or legal basis for processing their personal data. References: : CDPSE Review Manual (Digital Version), page 2

The best way for an organization to ensure its vendors are complying with data privacy requirements defined in their contracts is to obtain independent assessments of the vendors’ data management processes, because this will provide an objective and reliable evaluation of the vendors’ privacy practices, policies, and controls. Independent assessments can be performed by external auditors, consultants, or certification bodies that have the expertise and credibility to verify the vendors’ compliance with the contractual obligations and expectations. Independent assessments can also help identify and address any privacy risks or gaps that may arise from the vendors’ processing of personal data12.

References:

• CDPSE Exam Content Outline, Domain 1 – Privacy Governance (Governance, Management & Risk Management), Task 7: Participate in the management and evaluation of contracts, service levels and practices of vendors and other external parties3.
• CDPSE Review Manual, Chapter 1 – Privacy Governance, Section 1.4 – Third-Party Management4.

National data privacy legislative and regulatory requirements in each relevant jurisdiction are the most important data protection consideration for a global organization that is planning to implement a customer relationship management (CRM) system to be used in offices based in multiple countries, as they would determine the legal obligations and responsibilities of the organization with respect to the collection, use, disclosure and transfer of customer personal data across different jurisdictions. National data privacy legislative and regulatory requirements may vary significantly from country to country, depending on the type or nature of personal data or data processing activities, and may impose different rules and standards for obtaining consent, providing notice, ensuring security, enforcing rights, reporting breaches, appointing representatives or transferring data. The organization would need to comply with the national data privacy legislative and regulatory requirements in each relevant jurisdiction where it operates or where its customers are located, and to implement appropriate measures and safeguards to ensure compliance. The other options are not as important as national data privacy legislative and regulatory requirements in each relevant jurisdiction as data protection considerations for a global organization that is planning to implement a CRM system to be used in offices based in multiple countries. Industry best practice related to information security standards in each relevant jurisdiction may provide some guidance or benchmarks for ensuring security of customer personal data, but they may not reflect the specific context or needs of the organization or the customers, or comply with the legal obligations and responsibilities of the organization. Identity and access management mechanisms to restrict access based on need to know may help to protect customer personal data from unauthorized access, modification or disclosure by internal or external parties, but they may not address other aspects of data protection, such as consent, notice, rights, breaches, representatives or transfers. Encryption algorithms for securing customer personal data at rest and in transit may help to protect customer personal data from unauthorized access, modification or disclosure by internal or external parties, but they may not address other aspects of data protection, such as consent, notice, rights, breaches, representatives or transfers1, p. 63-64 References: 1: CDPSE Review Manual (Digital Version)

Software hardening is a technique that mitigates design flaws in the application development process that may contribute to potential leakage of personal data. Software hardening is a process of modifying or configuring software to make it more secure and resilient against attacks or exploitation. Software hardening can involve various methods, such as removing unnecessary features or functions, disabling debugging or testing modes, applying patches or updates, implementing secure coding practices, etc. Software hardening helps to protect personal data by preventing or reducing the vulnerabilities that can allow unauthorized access, use, disclosure, or transfer of personal data. References: : CDPSE Review Manual (Digital Version), page 151

Beacons use Bluetooth low-energy (BLE) wireless technology to transmit information to nearby devices that have Bluetooth enabled. By disabling Bluetooth services on the mobile device, the user can prevent beacons from detecting and tracking their location and sending them unwanted messages or advertisements. This can help protect the user’s privacy and avoid potential security risks from malicious beacons. Disabling location services, enabling Trojan scanners, or enabling antivirus for mobile devices are not effective ways to address threats to mobile device privacy when using beacons as a tracking technology, because they do not prevent the communication between beacons and the mobile device.

References:

• Beacon Technology: What It Is and How It Impacts You1
• What Does It All Mean: Beacon Technology, GPS and Geofencing2

Encryption of network traffic is the most important control to mitigate the risk of potential personal data compromise when employees access corporate IT assets remotely. Encryption is a process that transforms data into an unreadable form, making it difficult for unauthorized parties to intercept, modify, or steal it. Encryption of network traffic ensures that the data transmitted between the remote employees and the corporate network is protected from eavesdropping, tampering, or leakage.

Intrusion prevention system (IPS), firewall rules review, and intrusion detection system (IDS) are also useful controls for network security, but they are not as effective as encryption for protecting personal data in transit. IPS and IDS can monitor and block malicious or suspicious network traffic, but they cannot prevent data exposure if the traffic is intercepted by a third party. Firewall rules review can help optimize and secure the firewall configuration, but it cannot guarantee that the firewall will not be bypassed or compromised by an attacker. Therefore, encryption of network traffic is the best option among the choices given.

The greatest privacy risk for client-side application processing is an employee loading personal information on a company laptop. Client-side application processing refers to performing data processing operations on the user’s device or browser, rather than on a server or cloud. This can improve performance and user experience, but also pose privacy risks if the user’s device is lost, stolen, hacked, or infected with malware. An employee loading personal information on a company laptop is exposing that information to potential threats on the client-side, such as unauthorized access, use, disclosure, modification, or loss. Therefore, an organization should implement appropriate security measures to protect personal information on client-side devices, such as encryption, authentication, authorization, logging, monitoring, etc. References: : CDPSE Review Manual (Digital Version), page 153

Privacy threat modeling is a methodology for identifying and mitigating privacy threats in a software architecture. It helps to ensure that privacy is considered in the design and development of software systems, and that privacy risks are minimized or eliminated. Privacy threat modeling typically involves the following steps: defining the scope and context of the system, identifying the data flows and data elements, identifying the privacy threats and their sources, assessing the impact and likelihood of the threats, and applying appropriate countermeasures to mitigate the threats. References: : CDPSE Review Manual (Digital Version), page 97

Data anonymization is a method of protecting personal data by modifying or removing any information that can be used to identify an individual, either directly or indirectly, in a data set. Data anonymization aims to prevent the re-identification of the data subjects, even by the data controller or processor, or by using additional data sources or techniques. Data anonymization also helps to comply with data protection laws and regulations, such as the General Data Protection Regulation (GDPR) or the California Consumer Privacy Act (CCPA), which require data controllers and processors to respect the privacy rights and preferences of the data subjects.

The data is transformed such that re-identification is impossible is an example of data anonymization, as it involves applying irreversible techniques, such as aggregation, generalization, perturbation, or synthesis, to alter the original data in a way that preserves their utility and meaning, but eliminates their identifiability. For example, a database of customer transactions can be anonymized by replacing the names and addresses of the customers with random codes, and by adding noise or rounding to the amounts and dates of the transactions.

The other options are not examples of data anonymization, but of other methods of protecting personal data that do not guarantee the impossibility of re-identification. The data is encrypted and a key is required to re-identify the data is an example of data pseudonymization, which is a method of replacing direct identifiers with pseudonyms, such as codes or tokens, that can be linked back to the original data with a key or algorithm. Data pseudonymization does not prevent re-identification by authorized parties who have access to the key or algorithm, or by unauthorized parties who can break or bypass the encryption. Key fields are hidden and unmasking is required to access to the data is an example of data masking, which is a method of concealing or obscuring sensitive data elements, such as names or credit card numbers, with characters, symbols or blanks. Data masking does not prevent re-identification by authorized parties who have permission to unmask the data, or by unauthorized parties who can infer or guess the hidden data from other sources or clues. Names and addresses are removed but the rest of the data is left untouched is an example of data deletion, which is a method of removing direct identifiers from a data set. Data deletion does not prevent re-identification by using indirect identifiers, such as age, gender, occupation or location, that can be combined or matched with other data sources to re-establish the identity of the data subjects.

References:

• Big Data Deidentification, Reidentification and Anonymization - ISACA, section 2: “Anonymization is the ability for the data controller to anonymize the data in a way that it is impossible for anyone to establish the identity of the data.”
• Data Anonymization - Overview, Techniques, Advantages, section 1: “Data anonymization is a method of ensuring that the company understands and enforces its duty to secure sensitive, personal, and confidential data in a world of highly complex data protection mandates that can vary depending on where the business and the customers are based.”

Data loss prevention (DLP) tools are technologies that help to prevent unauthorized access, use, or transfer of personal data. DLP tools can monitor, detect, and block data leakage or exfiltration from various sources, such as endpoints, networks, cloud services, or email. DLP tools can also enforce data protection policies and compliance requirements, such as encryption, masking, or deletion of sensitive data. DLP tools can help to protect personal data from both internal and external threats, such as malicious insiders, hackers, or accidental exposure.

References:

• Data protection solutions rely on technologies such as data loss prevention (DLP), storage with built-in data protection, firewalls, encryption, and endpoint protection, Cloudian
• Top 10 Hot Data Security And Privacy Technologies, Forbes

Anonymization is a technique that removes or modifies all identifiers in a data set to prevent or limit the identification of the data subjects. Anonymization is an IT privacy practitioner’s best recommendation to reduce privacy risk before an organization provides personal data to a third party, as it would protect the privacy of the data subjects by reducing the linkability of the data set with their original identity, and also comply with the data minimization principle that requires limiting the collection, storage and processing of personal data to what is necessary and relevant for the intended purposes. Anonymization would also preserve some characteristics or patterns of the original data that can be used for analysis or research purposes by the third party, without compromising the accuracy or quality of the results. The other options are not as effective as anonymization in reducing privacy risk before an organization provides personal data to a third party. Tokenization is a technique that replaces sensitive or confidential data with non-sensitive tokens or placeholders that do not reveal the original data, but it does not prevent or limit the identification of the data subjects, as tokens can be reversed or linked back to the original data using a tokenization system or key. Aggregation is a technique that combines individual data into groups or categories that do not reveal the identity of the data subjects, but it may not prevent or limit the identification of the data subjects, as aggregated data can be de-aggregated or re-identified using other sources of information or techniques. Encryption is a technique that transforms plain text data into cipher text using an algorithm and a key, making it unreadable by unauthorized parties, but it does not prevent or limit the identification of the data subjects, as encrypted data can be decrypted or linked back to the original data using an encryption system or key1, p. 74-75 References: 1: CDPSE Review Manual (Digital Version)

The organization should disclose the relationship to those affected in jurisdictions where such disclosures are required, as this is the most appropriate and compliant action to take after identifying a privacy risk related to third-party data collection. Disclosing the relationship to the data subjects is a way of providing transparency and accountability, as well as respecting their rights and choices regarding their personal data. It also helps the organization avoid regulatory fines or sanctions for not complying with the applicable privacy laws or regulations that mandate such disclosures. The other options are not as effective or sufficient as disclosing the relationship, as they do not address the root cause of the risk, do not mitigate the potential harm to the data subjects, or do not align with the privacy principles and best practices.

References: CDPSE Review Manual, 2021, p. 36

Height, weight, and activities are the most legitimate information to collect for business reasons in this situation, as they are directly related to the purpose and functionality of a wellness smartwatch application that aims to monitor and improve the health and fitness of its users. Collecting height, weight, and activities would also comply with the data minimization principle that requires limiting the collection, storage and processing of personal data to what is necessary and relevant for the intended purposes. The other options are not legitimate information to collect for business reasons in this situation, as they are not related to the purpose and functionality of a wellness smartwatch application and may violate the privacy rights and preferences of its users. Collecting sleep schedule and calorie intake may be useful for some users who want to track their sleep quality and nutrition intake, but they are not essential for a wellness smartwatch application and may require additional consent or justification from the users. Collecting education and profession may be irrelevant for a wellness smartwatch application and may be used for other purposes, such as marketing or profiling, without the consent or knowledge of the users. Collecting race, age, and gender may be sensitive for some users who do not want to disclose their personal characteristics or identity, and may require additional safeguards or measures to protect their privacy1, p. 75-76 References: 1: CDPSE Review Manual (Digital Version)

 Including privacy requirements in vendor contracts is the best way to ensure privacy considerations are included when working with vendors because it establishes the obligations, expectations and responsibilities of both parties regarding the protection of personal data. It also provides a legal basis for enforcing compliance and resolving disputes. Including privacy requirements in the request for proposal (RFP) process, monitoring privacy-related service level agreements (SLAs) and requiring vendors to complete privacy awareness training are helpful measures, but they do not guarantee that vendors will adhere to the privacy requirements or that they will be held accountable for any violations.

References:

• CDPSE Review Manual (Digital Version), Domain 1: Privacy Governance, Task 1.7: Participate in the management and evaluation of contracts, service levels and practices of vendors and other external parties1
• CDPSE Certified Data Privacy Solutions Engineer All-in-One Exam Guide, Chapter 2: Privacy Governance, Section: Vendor Management2

The best way to ensure an organization’s enterprise risk management (ERM) framework can protect the organization from privacy harms is to complete a privacy risk assessment. A privacy risk assessment is a systematic process of identifying, analyzing, evaluating, and treating the privacy risks that may affect the organization’s objectives, operations, stakeholders, and reputation. A privacy risk assessment helps to align the ERM framework with the privacy requirements, expectations, and obligations of the organization, as well as to prioritize and mitigate the privacy risks that may cause privacy harms. Privacy harms are the adverse consequences or impacts that may result from the unauthorized or inappropriate use, disclosure, or loss of personal data, such as financial loss, identity theft, discrimination, reputational damage, emotional distress, or physical harm.

References: CDPSE Review Manual, 2021, p. 84

The first consideration for ensuring that endpoints are protected in line with the privacy policy is hardening the operating systems of endpoint devices. Hardening is a process of applying security configurations and controls to reduce the attack surface and vulnerabilities of an operating system. Hardening can include disabling unnecessary services and features, applying security patches and updates, enforcing strong passwords and encryption, configuring firewall and antivirus settings, and implementing least privilege principles. Hardening the operating systems of endpoint devices can help prevent unauthorized access, data leakage, malware infection, or other threats that may compromise the privacy of personal data stored or processed on those devices.

Detecting malicious access through endpoints, implementing network traffic filtering on endpoint devices, and managing remote access and control are also important aspects of endpoint security, but they are not the first consideration. Rather, they are dependent on or complementary to hardening the operating systems of endpoint devices. For example, detecting malicious access requires having a baseline of normal activity and behavior on the endpoint device, which can be established by hardening. Implementing network traffic filtering requires having a firewall or other network security tool installed and configured on the endpoint device, which is part of hardening. Managing remote access and control requires having authentication and authorization mechanisms in place on the endpoint device, which is also part of hardening.

References: Manage endpoint security policies in Microsoft Intune, ENDPOINT SECURITY POLICY, How To Build An Effective Endpoint Security Policy And Prevent Cyberattacks

A data loss prevention (DLP) tool is a software solution that monitors, detects and prevents the unauthorized transmission or leakage of sensitive data, such as personal data, from an organization’s network or devices. A DLP tool can help to ensure the effectiveness of a policy requiring the encryption of personal data if transmitted through email, by applying the following controls:

• Scanning the content and attachments of outgoing emails for personal data, such as names, email addresses, biometric data, IP addresses, etc.
• Blocking or quarantining emails that contain unencrypted personal data, and alerting the sender and/or the administrator of the policy violation.
• Encrypting personal data automatically before sending them through email, using encryption standards and algorithms that are compliant with data protection laws and regulations, such as the General Data Protection Regulation (GDPR) or the California Consumer Privacy Act (CCPA).
• Generating audit logs and reports of email activities and incidents involving personal data, and providing visibility and accountability for policy compliance.

The other options are less effective or irrelevant to ensure the effectiveness of the policy. Providing periodic user awareness training on data encryption is a good practice, but it does not guarantee that users will follow the policy or know how to encrypt personal data properly. Conducting regular control self-assessments (CSAs) is a useful method to evaluate the design and operation of the policy, but it does not prevent or detect policy violations in real time. Enforcing annual attestation to policy compliance is a formal way to demonstrate user commitment to the policy, but it does not verify or measure the actual level of compliance.

References:

• The Complexity Conundrum: Simplifying Data Security - ISACA, section 3: “Data loss prevention (DLP) solutions can help prevent unauthorized access to sensitive information by monitoring network traffic for specific keywords or patterns.”
• Guide to Securing Personal Data in Electronic Medium, section 3.2: “Organisations should consider implementing DLP solutions to prevent unauthorised disclosure of personal data via email.”
• Encryption in the Hands of End Users - ISACA, section 2: “A key goal of encryption is to protect the file even when direct access is possible or the transfer is intercepted.”

A privacy notice is a document that informs data subjects about how their personal data is collected, processed, stored, shared, and protected by an organization. The primary purpose of a privacy notice is to provide transparency to the data subject on the intended use of their personal data, as well as their rights and choices regarding their data. A privacy notice also helps the organization comply with legal and regulatory requirements, such as obtaining consent, demonstrating accountability, and fulfilling the principle of fairness and lawfulness.

References: CDPSE Review Manual, 2021, p. 36

The proportionality of the data collected for the intended purpose is the most important privacy consideration when developing a contact tracing application. This means that the application should only collect the minimum amount of personal data necessary to achieve the specific and legitimate purpose of preventing and controlling the spread of COVID-191. The application should also ensure that the data collected are relevant, adequate, and not excessive in relation to the purpose2. The application should avoid collecting or processing any data that are not essential for the purpose, such as location data, biometric data, or health data unrelated to COVID-193. The application should also respect the data minimization principle, which requires that the data are kept for no longer than necessary for the purpose4. References:

• European Data Protection Board Guidelines 04/2020 on the use of location data and contact tracing tools in the context of the COVID-19 outbreak
• Article 5(1)© of the General Data Protection Regulation (GDPR)
• Article 29 Data Protection Working Party Opinion 04/2017 on the Proposed Regulation for the ePrivacy Regulation
• Article 5(1)(e) of the GDPR

Obtaining executive support is the first step in developing an organization-wide strategy to address data privacy risk, as it ensures that the privacy program has the necessary resources, authority, and alignment with the organization’s goals and objectives. Without executive support, the privacy program may face challenges in implementing and enforcing privacy policies, procedures, and controls across the organization. References: 2 Domain 1, Task 1

Using hash values with stored personal data best enables an organization to detect changes to the data, because hash values are unique and fixed outputs that are generated from the data using a mathematical algorithm. If the data is altered in any way, even by a single bit, the hash value will change dramatically. Therefore, by comparing the current hash value of the data with the original or expected hash value, the organization can verify the integrity and authenticity of the data. If the hash values match, it means that the data has not been tampered with. If the hash values differ, it means that the data has been corrupted or modified.

References:

• Ensuring Data Integrity with Hash Codes, Microsoft Learn
• What is ‘hashing,’ and does it help avoid the obligations imposed by the new privacy regulations?, Data Privacy Dish

Ensuring appropriate data classification should be done next after a migration of personal data involving a data source with outdated documentation has been approved by senior management, as it helps to identify the types, locations, and owners of the data, and to apply the appropriate privacy controls and measures based on the data classification level. Data classification also facilitates the data discovery, data minimization, data retention, and data disposal processes15. References: 1 Domain 3, Task 2; 5 Page 9

The data subject should contact the organization’s chief privacy officer (CPO) first if they believe their personal information has been collected and used without consent. The CPO is the senior executive who is responsible for establishing and maintaining the organization’s privacy vision, strategy, and program. The CPO oversees the development and implementation of privacy policies, procedures, standards, and controls, and ensures that they align with the organization’s business objectives and legal obligations. The CPO also leads the privacy governance structure, such as the privacy steering committee, and coordinates with other stakeholders, such as the data protection authorities, the privacy rights advocates, and the outside privacy counsel, to ensure that privacy is integrated into all aspects of the organization’s operations. The CPO is the primary point of contact for data subjects who have any questions, complaints, or requests regarding their personal information, and who can address their concerns and resolve their issues in a timely and effective manner. References: : CDPSE Review Manual (Digital Version), page 21

A mobile application implementation should meet the organization’s data security standards by ensuring that the application does not contain any vulnerabilities, errors or malicious code that could compromise the confidentiality, integrity or availability of the data. An automatic dynamic code scan is a technique that analyzes the application code while it is running to detect and report any security issues or defects. An automatic dynamic code scan can help to identify and fix any potential data security risks before the application is deployed. The other options are not sufficient to ensure data security standards. UAT is a process of verifying that the application meets the user requirements and expectations, but it does not necessarily test for data security. Data classification is a process of categorizing data according to its sensitivity and value, but it does not ensure that the data is protected by the application. A PIA is a process of identifying and evaluating the privacy impacts of a system or project that involves personal data, but it does not ensure that the system or project meets data security standards. , p. 89-90 References: : CDPSE Review Manual (Digital Version)

The most important thing to consider when managing changes to the provision of services by a third party that processes personal data is the business impact due to the changes. Changes to the provision of services by a third party can affect the organization’s ability to meet its business objectives and legal obligations related to data processing activities. For example, changes to the service level agreement (SLA), the scope of services, the security measures, the location of servers, etc., can have implications for the quality, availability, confidentiality, integrity, and compliance of personal data processing. Therefore, an IT privacy practitioner should assess and evaluate the business impact due to the changes, and ensure that they are aligned with the organization’s privacy policies and applicable privacy regulations and standards. References: : CDPSE Review Manual (Digital Version), page 41

A data use policy is a document that defines the rules and guidelines for how personal data are collected, used, stored, shared and deleted by an organization. It is an important part of data governance and compliance, as it helps to ensure that personal data are handled in a lawful, fair and transparent manner, respecting the rights and preferences of data subjects. A data use policy should include the requirements for collecting and using personal data, such as the legal basis, the purpose, the scope, the consent, the data minimization, the accuracy, the security and the accountability. These requirements help to establish the legitimacy and necessity of data processing activities, and to prevent unauthorized or excessive use of personal data.

References:

• ISACA Privacy Notice & Usage Disclosures, section 2.1: “We collect Personal Information from you when you provide it to us directly or through a third party who has assured us that they have obtained your consent.”
• Chapter Privacy Policy - Singapore Chapter - ISACA, section 2: “We will collect your personal data in accordance with the PDPA either directly from you or your authorized representatives, and/or through our third party service providers.”
• Data Minimization—A Practical Approach - ISACA, section 2: “Enterprises may only collect as much data as are necessary for the purposes defined at the time of collection, which may also be set out in a privacy notice (sometimes referred to as a privacy statement, a fair processing statement or a privacy policy).”
• Establishing Enterprise Roles for Data Protection - ISACA, section 3: “Data governance is typically implemented in organizations through policies, guidelines, tools and access controls.”

A private cloud is a cloud deployment model that provides exclusive access and control to a single organization or a specific group of users within the organization. A private cloud is best for an organization whose main objectives are to logically isolate personal data from other tenants and adopt custom privacy controls for the data, as it offers the highest level of security, privacy, and customization among the cloud deployment models. A private cloud allows the organization to implement its own privacy policies, standards, and procedures for the personal data, as well as to configure the cloud infrastructure, services, and applications according to its specific needs and preferences. A private cloud also reduces the risk of data breaches, unauthorized access, or co-mingling of data from other tenants, as the personal data is stored and processed in a dedicated and isolated environment.

References: CDPSE Review Manual, 2021, p. 125

An audit log is a record of the activities and events that occur in an information system, such as an application hosting personal data. An audit log can help to monitor, detect, investigate and prevent unauthorized or malicious access, use, modification or deletion of personal data. An audit log can also help to demonstrate compliance with data protection laws and regulations, such as the General Data Protection Regulation (GDPR) or the California Consumer Privacy Act (CCPA). An audit log should capture the following information for each event: 9

• The date and time of the event
• The identity of the user or system that performed the event
• The type and description of the event
• The outcome or result of the event
• The personal data that were accessed, used, modified or deleted

The last user who accessed personal data is the most important information to capture in the audit log, as it can help to identify who is responsible for any data breach or misuse of personal data. It can also help to verify that only authorized and legitimate users have access to personal data, and that they follow the data use policy and the principle of least privilege. The last user who accessed personal data can also help to support data subjects’ rights, such as the right to access, rectify, erase or restrict their personal data.

The other options are less important or irrelevant to capture in the audit log of an application hosting personal data. Server details of the hosting environment are not related to personal data, and they can be obtained from other sources, such as network logs or configuration files. Last logins of privileged users are important to capture in a separate audit log for user account management, but they do not indicate what personal data were accessed or used by those users. Application error events are important to capture in a separate audit log for system performance and reliability, but they do not indicate what personal data were affected by those errors.

References:

• IS Audit Basics: Auditing Data Privacy, section 4: “Audit logs should be maintained for all systems that process PII.”
• Data Protection Audit Manual, section 3.2: “Audit trails should be kept for all processing operations involving personal data.”
• Audit Logging Best Practices, section 2: “An audit log entry should contain enough information to answer who did what and when.”