CIPM IAPP Practice Questions and verified answers

All of the following are factors in determining whether an organization can craft a common solution to the privacy requirements of multiple jurisdictions except: A. effective date of most restrictive law B. implementation complexity C. legal regulations D. cost - correct answers Building a privacy strategy may mean changing the mindset and perspective of an entire organization. Everyone in an organization has a role to play in protecting the personal information an organization collects, uses and discloses. Management needs to approve funding to resource and equip the privacy team, fund important privacy enhancing resources and technologies, support privacy initiatives such as training and awareness, and hold employees accountable for following privacy policies and procedures. Sales personnel must secure business contact data and respect the choices of these individuals. Developers and engineers must incorporate effective security controls, build safe websites, and create solutions that require the collection or use of only the data necessary to accomplish the purpose. Privacy Program Management, pgs.24-25 What is the value of a privacy workshop for an organization's stakeholders? A. A workshop ensures compliance to policies at all levels of an organization. B. A workshop ensures all stakeholders commit resources to the privacy program. C. A workshop ensures common baseline understanding of the risks and challenges. D. A workshop allows the privacy professional to create a single policy across the organization. - correct answers Don't assume that all stakeholders have the same level of understanding about the regulatory environment or the complexity of the undertaking—there will invariably be different levels of privacy knowledge among the group. This is an opportunity to ensure everyone has the same baseline understanding of the risks and challenges the organization faces, the data privacy obligations that are imposed on it and the increasing expectations in the marketplace regarding the protection of personal information. Privacy Program Management, pg.27 What are nongovernmental organizations that advocate for privacy protection known as? A. external privacy organizations B. privacy policy review boards C. privacy trade associations D. political action committees or - correct answers If an organization is small, or the privacy office staffing is limited, the privacy professional and organization could consider third-party solutions to track and monitor privacy laws relating to the business. These third parties include legal and consulting services that can assign people to the organization and use automated online services that allow research on privacy law, news and business tools. Privacy professionals from large and small firms can also take advantage of a growing number of free resources to help them to keep up-to- date with developments in privacy. Privacy Program Management, pg.58 When should stakeholders be identified in the development of a privacy framework ? A. after the privacy team has established its agenda B. during the data inventory C. during the review of written policies D. during the business case - correct answers Many organizations create a privacy committee or council composed of the stakeholders (or representatives of functions) that were identified at the start of the privacy program implementation process. These individuals and functions will launch the privacy program, and their expertise and involvement will continue to be tapped as remediation needs—some of which may sit within their areas of responsibility—are identified. They will be instrumental in making strategic decisions and driving them through their own departments. Privacy Program Management, pg.8 Which of the following is not a component of a data inventory? A. incident response protocol B. types of privacy-related information C. international transfers D. the format of the information - correct answers Questions can be used to determine the data assets of an organization. They should be specific to the organization's line of business and may be organized around the data lifecycle—collection, usage, transfers, retention and destruction. Internal policies and procedures, laws, regulations and standards may also be used to compose the questions. Based on these aspects, the data inventory offers a good starting point for the privacy team to prioritize resources, efforts, risk assessments and current policy in response to incidents. A data inventory should include the items in Table 4-1 [See Table 4-1]: Privacy Program Management, pg. 66 Where should an organization's procedures for resolving consumer complaints about privacy protection be found? A. in written policies regarding privacy B. in the emergency response plan C. in memoranda from the CEO D. in the minutes of corporate or organizational board meetings - correct answers The privacy policy is a high-level policy that supports documents such as standards and guidelines that focus on technology and methodologies for