CIPM ACTUAL RECENT QUESTIONS AND ANSWERS
SURE A+
✔✔Qualities of an effective privacy policy - ✔✔Clear and easy to understand: targeted
audience avoiding legal jargon
Accessible
Comprehensive yet concise
Action Oriented
Measurable and Testable
*Aligned with existing business procedures
*raise awareness
✔✔Policy Cost Considerations - ✔✔Most significant costs are related to implementing
the policy and addressing the impacts on the organization that potentially limit, reduce,
remove or change the way data is protected.
Changes made to a policy may affect ability to perform certain tasks and affect the
organization
Beyond that, the policy must be disseminated and then communicated through training
and awareness
✔✔Process for engaging vendors - ✔✔Have a consistent policy, identify, evaluate,
contract, monitor
✔✔Data Retention and Destruction - ✔✔PI should only be retained for as long as
necessary to perform the purpose
Destruction triggers/methods should be documented and align with laws
✔✔Types of policy requirements - ✔✔Notice, data retention limits, choice and consent,
individual rights, obligations
, ✔✔Goals of a cloud computing policy - ✔✔•Maintain compliance with policies, laws,
regulations and standards
•Ensure all cloud computing agreements are approved by appropriate leadership
•Maintain privacy and security of data
•Mitigate risks of processing data using cloud-based applications and tools
✔✔Four Privacy Notice Strategies - ✔✔Layered Approach: Key info with expandable
links
Just-in-time: type of layered, appears at time of collection, think smartphone alert
Icon: type of layered approach - clarity, indicators, reminders
Dashboard: easy to access/navigate
✔✔Notice vs. Consent - ✔✔Consent - must be able to prevent
Notice - inform but do not solicit or imply consent
*GDPR - consent might not be the only reliable bases for processing PI, lawful bases for
processing PI include contract, legal obligation, vital interest, public interest, legitimate
interest
✔✔Opt in vs. Opt out - ✔✔IN: Clear, positive way for an individual to indicate wishes,
such as check box that says i agree
Out: taking an action to prevent
✔✔CCPA Data Subject Rights - ✔✔Ability to request: type of data held about requestor,
sources and the specific PI, what is being done with it, 3rd party sharing
Full erauser
Opt out of selling data to 3rd parties
✔✔GDPR Data Subject Rights - ✔✔Right to Information
Right of Access
Right to Rectification (of inaccurate data)
Right to Erasure
Right to Restriction of Processing
Right to Portability: " data subjects have the right to receive their own personal data"
Automated decision making = profiling
✔✔Responding to withdrawals of consent - ✔✔.•As easily as it was to give it
•At any time
•As soon as possible (must be procedures in place to respond to the individual and to
cease processing)
•Without penalty
•In the same method that was used to give consent
SURE A+
✔✔Qualities of an effective privacy policy - ✔✔Clear and easy to understand: targeted
audience avoiding legal jargon
Accessible
Comprehensive yet concise
Action Oriented
Measurable and Testable
*Aligned with existing business procedures
*raise awareness
✔✔Policy Cost Considerations - ✔✔Most significant costs are related to implementing
the policy and addressing the impacts on the organization that potentially limit, reduce,
remove or change the way data is protected.
Changes made to a policy may affect ability to perform certain tasks and affect the
organization
Beyond that, the policy must be disseminated and then communicated through training
and awareness
✔✔Process for engaging vendors - ✔✔Have a consistent policy, identify, evaluate,
contract, monitor
✔✔Data Retention and Destruction - ✔✔PI should only be retained for as long as
necessary to perform the purpose
Destruction triggers/methods should be documented and align with laws
✔✔Types of policy requirements - ✔✔Notice, data retention limits, choice and consent,
individual rights, obligations
, ✔✔Goals of a cloud computing policy - ✔✔•Maintain compliance with policies, laws,
regulations and standards
•Ensure all cloud computing agreements are approved by appropriate leadership
•Maintain privacy and security of data
•Mitigate risks of processing data using cloud-based applications and tools
✔✔Four Privacy Notice Strategies - ✔✔Layered Approach: Key info with expandable
links
Just-in-time: type of layered, appears at time of collection, think smartphone alert
Icon: type of layered approach - clarity, indicators, reminders
Dashboard: easy to access/navigate
✔✔Notice vs. Consent - ✔✔Consent - must be able to prevent
Notice - inform but do not solicit or imply consent
*GDPR - consent might not be the only reliable bases for processing PI, lawful bases for
processing PI include contract, legal obligation, vital interest, public interest, legitimate
interest
✔✔Opt in vs. Opt out - ✔✔IN: Clear, positive way for an individual to indicate wishes,
such as check box that says i agree
Out: taking an action to prevent
✔✔CCPA Data Subject Rights - ✔✔Ability to request: type of data held about requestor,
sources and the specific PI, what is being done with it, 3rd party sharing
Full erauser
Opt out of selling data to 3rd parties
✔✔GDPR Data Subject Rights - ✔✔Right to Information
Right of Access
Right to Rectification (of inaccurate data)
Right to Erasure
Right to Restriction of Processing
Right to Portability: " data subjects have the right to receive their own personal data"
Automated decision making = profiling
✔✔Responding to withdrawals of consent - ✔✔.•As easily as it was to give it
•At any time
•As soon as possible (must be procedures in place to respond to the individual and to
cease processing)
•Without penalty
•In the same method that was used to give consent
