CIPM EXAM UPDATED SCRIPTED QUESTIONS
AND ANSWERS SURE A+
✔✔Hybrid Governance Model? Pro/Con? - ✔✔Combination of centralized and localized.
One individual is responsible for privacy related affairs, local entities then fulfill support.
Pro: Dictate core values but let employee decide which practice to use to obtain the
goals. More resources
Con: Less big picture vision
✔✔Requirements for a DPO - ✔✔As set out by GPDR:
Experience assessing risk and mitigation
Knowledge of laws
Effective communication with LOBs
Project Management
Handle Complaints - answer data subject ?s
No roles that conflict with the role of DPO
✔✔Internal Audit Process - ✔✔Tasks
Evaluate the organization's risk management culture
Identify risk factors
Evaluate control design and implementation
Tests controls to ensure operations
Independent of management - ensure unbiased reporting
✔✔Privacy Tech Vendors - PPM tools vs. EPM tools - ✔✔PPM Tools: work directly with
the privacy office on privacy assessment management, consent management, IR,
Cookie Compliance
EPM: require buy in from privacy, IT, C-Suite for data discovery, activity monitoring,
encryption, communications etc.
, Data Mapping = BOTH
✔✔Define GRC - ✔✔Governance, Risk Management, Compliance
references the critical capabilities that must work together to achieve principled
performance
✔✔Before a third-party acquisition the Privacy Program Manager should do what to
ensure compliance with all applicable laws, regulations, and standards. - ✔✔1. Identify
all applicable laws and regulations
2. Create a data inventory/map of current data assets, data collection, use, and
processing
✔✔Prior to an acquisition to ensure compliance with all applicable laws, regulations,
and standards what should the Privacy Program Manager do? - ✔✔1. Identify all
applicable laws, regulations and standards
2. Create data inventory/map of current data assets, data collection, usage, processing
3. Identify cross-border transfers
4. Determine current privacy practices of potential acquisition
5. Perform complete enterprise Privacy Impact Assessment (PIA)
6. Consider contractual requirements and notices already existing
✔✔GDPR: What Consumers Can Do - ✔✔Withdraw consent, request a copy of their
personal information to move to another organization or have data deleted, object to
automated decision-making processing of PII, Influence regulators
✔✔GDPR: What Organizations must do - ✔✔• Privacy by default and by design
• Maintain appropriate data security
• Notify data subjects and regulators of breaches in some circumstances
• Special rules for children's data
• Provide notice of intention to process personal information
• Take responsibility for processing activities of 3rd party vendors
• Conduct Data Protection Impact Assessments in some situations
• Ensure adequacy or appropriate safeguards for data transfers
• Consult regulators before processing
• Keep records and demonstrate compliance
✔✔GDPR: What Regulators May Do - ✔✔Ask for records of compliance
Impose temporary data processing bans
Require breach notifications
Order erasure of PI
Suspend cross-border data flows
Enforce penalties
AND ANSWERS SURE A+
✔✔Hybrid Governance Model? Pro/Con? - ✔✔Combination of centralized and localized.
One individual is responsible for privacy related affairs, local entities then fulfill support.
Pro: Dictate core values but let employee decide which practice to use to obtain the
goals. More resources
Con: Less big picture vision
✔✔Requirements for a DPO - ✔✔As set out by GPDR:
Experience assessing risk and mitigation
Knowledge of laws
Effective communication with LOBs
Project Management
Handle Complaints - answer data subject ?s
No roles that conflict with the role of DPO
✔✔Internal Audit Process - ✔✔Tasks
Evaluate the organization's risk management culture
Identify risk factors
Evaluate control design and implementation
Tests controls to ensure operations
Independent of management - ensure unbiased reporting
✔✔Privacy Tech Vendors - PPM tools vs. EPM tools - ✔✔PPM Tools: work directly with
the privacy office on privacy assessment management, consent management, IR,
Cookie Compliance
EPM: require buy in from privacy, IT, C-Suite for data discovery, activity monitoring,
encryption, communications etc.
, Data Mapping = BOTH
✔✔Define GRC - ✔✔Governance, Risk Management, Compliance
references the critical capabilities that must work together to achieve principled
performance
✔✔Before a third-party acquisition the Privacy Program Manager should do what to
ensure compliance with all applicable laws, regulations, and standards. - ✔✔1. Identify
all applicable laws and regulations
2. Create a data inventory/map of current data assets, data collection, use, and
processing
✔✔Prior to an acquisition to ensure compliance with all applicable laws, regulations,
and standards what should the Privacy Program Manager do? - ✔✔1. Identify all
applicable laws, regulations and standards
2. Create data inventory/map of current data assets, data collection, usage, processing
3. Identify cross-border transfers
4. Determine current privacy practices of potential acquisition
5. Perform complete enterprise Privacy Impact Assessment (PIA)
6. Consider contractual requirements and notices already existing
✔✔GDPR: What Consumers Can Do - ✔✔Withdraw consent, request a copy of their
personal information to move to another organization or have data deleted, object to
automated decision-making processing of PII, Influence regulators
✔✔GDPR: What Organizations must do - ✔✔• Privacy by default and by design
• Maintain appropriate data security
• Notify data subjects and regulators of breaches in some circumstances
• Special rules for children's data
• Provide notice of intention to process personal information
• Take responsibility for processing activities of 3rd party vendors
• Conduct Data Protection Impact Assessments in some situations
• Ensure adequacy or appropriate safeguards for data transfers
• Consult regulators before processing
• Keep records and demonstrate compliance
✔✔GDPR: What Regulators May Do - ✔✔Ask for records of compliance
Impose temporary data processing bans
Require breach notifications
Order erasure of PI
Suspend cross-border data flows
Enforce penalties
