CIPM FINAL EXAM ACTUAL QUESTIONS AND
ANSWERS SURE A+
✔✔When can Data Mapping be used - ✔✔• A precursor to compliance and risk analysis
• Assess data, systems, processes
• Inform data assessments, priorities, life cycle management
✔✔How to Start Data Mapping? - ✔✔1. Who is responsible? Often budget shared
across depts.
2. Identify depts that hold and use PI - can be done via internal audit or outside
consultancy
3. Plan intake questions - organized around data lifecycle (collection, usage, transfers,
retention, destruction, security), should be specific to LOBs
✔✔Define and Describe a Privacy Assessment - ✔✔Measure an organization's
compliance
Can be on scheduled basis, ad hoc as a result of a privacy or security event, or upon
request from an authority.
Can review logs, scores, tools or interviews/questionnaires
Can be conducted by internal auditor, DPO, Business Function, third party
Document results and analyze for improvement/remediation
✔✔Define and describe a Privacy IMPACT Assessment - ✔✔Specifically assess the
privacy risks associated with processing PI in relation to a project, product, or service.
Should be conducted prior to a deployment that involved the collection of PI, when there
are new standards regulations or policies, or a change in methods to which PI is
handled, collection of new information
This allows stakeholders to dedicate resources more effectively
, ✔✔DPIA vs. PIA - ✔✔DPIA=EU
Synonymous except DPIA has specific triggers and requirements under GDPR
Values of DPIA: Incorporate privacy considerations into org planning, demonstrate
GDPR Compliance
✔✔DPIA Triggers - ✔✔Article 35: processing is likely to result in high risk to rights and
freedoms
Use of new technologies whose risks are less understood may increase likelihood
✔✔DPIA Components - ✔✔Description of the processing, including purpose and
legitimate interest
Necessity of processing and its proportionality of risk
Measures to address risks
✔✔What is Attestation? - ✔✔A tool for ensuring functions outside the privacy team are
held accountable for privacy responsibilities
Answering yes/no questions and maybe providing evidence
✔✔Physical environments that may require risk assessment - ✔✔Data centers, offices,
physical access, telework, media sanitation and disposal, device forensices, device
security (imaging/hardware)
✔✔Vendor Considerations - ✔✔Type of data outsourced, location, cloud, records
retention, contract requirements, minimum standards, retention
✔✔Contracts with vendors may want to include: - ✔✔specifics regarding the type of
personal information to which vendor will have access, vendor plans to protect PI,
vendor responsibilities in the event of a data breach, data disposal upon contract
termination, limitations for specific purposes, rights of audit/investigation, data breach
liability
✔✔Controller's use of processors under GDPR is limited to - ✔✔Sufficient Guarantees:
obtaining proof of the processor's competence
Processor has duty to assist the control with achieving compliance, reducing risk,
breach notification
✔✔an M&A privacy checkpoint should include - ✔✔Applicable new compliance
requirements (sector specific, jurisdictional, standards)
Existing client agreements
ANSWERS SURE A+
✔✔When can Data Mapping be used - ✔✔• A precursor to compliance and risk analysis
• Assess data, systems, processes
• Inform data assessments, priorities, life cycle management
✔✔How to Start Data Mapping? - ✔✔1. Who is responsible? Often budget shared
across depts.
2. Identify depts that hold and use PI - can be done via internal audit or outside
consultancy
3. Plan intake questions - organized around data lifecycle (collection, usage, transfers,
retention, destruction, security), should be specific to LOBs
✔✔Define and Describe a Privacy Assessment - ✔✔Measure an organization's
compliance
Can be on scheduled basis, ad hoc as a result of a privacy or security event, or upon
request from an authority.
Can review logs, scores, tools or interviews/questionnaires
Can be conducted by internal auditor, DPO, Business Function, third party
Document results and analyze for improvement/remediation
✔✔Define and describe a Privacy IMPACT Assessment - ✔✔Specifically assess the
privacy risks associated with processing PI in relation to a project, product, or service.
Should be conducted prior to a deployment that involved the collection of PI, when there
are new standards regulations or policies, or a change in methods to which PI is
handled, collection of new information
This allows stakeholders to dedicate resources more effectively
, ✔✔DPIA vs. PIA - ✔✔DPIA=EU
Synonymous except DPIA has specific triggers and requirements under GDPR
Values of DPIA: Incorporate privacy considerations into org planning, demonstrate
GDPR Compliance
✔✔DPIA Triggers - ✔✔Article 35: processing is likely to result in high risk to rights and
freedoms
Use of new technologies whose risks are less understood may increase likelihood
✔✔DPIA Components - ✔✔Description of the processing, including purpose and
legitimate interest
Necessity of processing and its proportionality of risk
Measures to address risks
✔✔What is Attestation? - ✔✔A tool for ensuring functions outside the privacy team are
held accountable for privacy responsibilities
Answering yes/no questions and maybe providing evidence
✔✔Physical environments that may require risk assessment - ✔✔Data centers, offices,
physical access, telework, media sanitation and disposal, device forensices, device
security (imaging/hardware)
✔✔Vendor Considerations - ✔✔Type of data outsourced, location, cloud, records
retention, contract requirements, minimum standards, retention
✔✔Contracts with vendors may want to include: - ✔✔specifics regarding the type of
personal information to which vendor will have access, vendor plans to protect PI,
vendor responsibilities in the event of a data breach, data disposal upon contract
termination, limitations for specific purposes, rights of audit/investigation, data breach
liability
✔✔Controller's use of processors under GDPR is limited to - ✔✔Sufficient Guarantees:
obtaining proof of the processor's competence
Processor has duty to assist the control with achieving compliance, reducing risk,
breach notification
✔✔an M&A privacy checkpoint should include - ✔✔Applicable new compliance
requirements (sector specific, jurisdictional, standards)
Existing client agreements
