CDPSE Certified Data Privacy Solutions Engineer Question and Answers

The primary consideration of a multinational organization deploying a user and entity behavior analytics (UEBA) tool to centralize the monitoring of anomalous employee behavior is cross-border data transfer, because it may involve the transfer of personal data across different jurisdictions with different privacy laws and regulations. The organization needs to ensure that it complies with the applicable legal requirements and safeguards the privacy rights of its employees when transferring their data to a central location for analysis. The other options are secondary or operational considerations that may not have a significant impact on the privacy of the employees.

The primary reason that a single cryptographic key should be used for only one purpose, such as encryption or authentication, is that it minimizes the risk if the cryptographic key is compromised. A cryptographic key is a piece of information that is used to perform cryptographic operations, such as encryption or authentication. Encryption is a process of transforming data into an unreadable form using a secret key or algorithm. Authentication is a process of verifying the identity or integrity of a user or data using a secret key or algorithm. If a single cryptographic key is used for multiple purposes, such as encryption and authentication, it increases the risk if the cryptographic key is compromised. For example, if an attacker obtains the cryptographic key that is used for both encryption and authentication, they can decrypt and access personal data, as well as impersonate or modify legitimate users or data. Therefore, a single cryptographic key should be used for only one purpose, and different keys should be used for different purposes. References: : CDPSE Review Manual (Digital Version), page 107

Cloud vendor agreements are the best way to ensure an organization’s data retention requirements will be met in the public cloud environment because they define the roles, responsibilities and obligations of both parties regarding the collection, storage, processing and disposal of data in the cloud. They also specify the terms and conditions for data protection, security, privacy, compliance and auditability12. Data classification schemes, automated data deletion schedules and service level agreements (SLAs) are useful tools to manage and monitor data retention, but they do not guarantee that the cloud vendor will adhere to the organization’s data retention requirements or that they will be enforceable in case of disputes.

Automated data discovery and classification tools provide continuous and systematic identification of data assets across the enterprise, ensuring accuracy and reducing manual errors. Internal updates (B) and departmental reporting (D) depend on human diligence; periodic manual audits (C) are time-bound and may miss changes between reviews.

“Automated discovery ensures a current and reliable data inventory, critical for privacy compliance.”

Public key infrastructure (PKI) is a system that enables the use of public key cryptography, which is a method of encrypting and authenticating data using a pair of keys: a public key and a private key. Public key cryptography can protect against man-in-the-middle (MITM) attacks, which are attacks where an attacker intercepts and modifies the communication between two parties. PKI makes public key cryptography feasible by providing a way to generate, distribute, verify, and revoke public keys. PKI also uses digital certificates, which are documents that bind a public key to an identity, and certificate authorities, which are trusted entities that issue and validate certificates. By using PKI, the parties can ensure that they are communicating with the intended recipient and that the data has not been tampered with by an attacker.

One of the foundational goals of data privacy laws is to give people rights over the collection of personal data, such as the right to access, correct, delete, or object to the processing of their data. Privacy laws also aim to protect people’s dignity, autonomy, and self-determination in relation to their personal data. The other options are not accurate or complete descriptions of the purpose of data privacy laws.

Consent tagging is a metadata-driven process that associates consent preferences with an individual’s data, enabling organizations to manage consent dynamically across systems. It is not limited to cookies (A), one-time logging (C), or initial requests (D).

“Consent tagging links an individual’s data with their recorded consent choices for compliant processing.”

Data loss prevention (DLP) tools are technologies that help to prevent unauthorized access, use, or transfer of personal data. DLP tools can monitor, detect, and block data leakage or exfiltration from various sources, such as endpoints, networks, cloud services, or email. DLP tools can also enforce data protection policies and compliance requirements, such as encryption, masking, or deletion of sensitive data. DLP tools can help to protect personal data from both internal and external threats, such as malicious insiders, hackers, or accidental exposure.

The practice that best indicates an organization follows the data minimization principle is that data is regularly reviewed for its relevance. The data minimization principle is one of the core principles of data protection under various laws and regulations, such as the GDPR or the CCPA. It states that personal data should be adequate, relevant, and limited to what is necessary in relation to the purposes for which they are processed. By regularly reviewing the data they hold, organizations can ensure that they do not collect or retain excessive or unnecessary data that may pose privacy risks or violate data subject rights.

Data is pseudonymized when being backed up, data is encrypted before storage, or data is only accessible on a need-to-know basis are also good practices for data protection, but they do not directly indicate that the organization follows the data minimization principle. Pseudonymization is a process of replacing identifying information in data with artificial identifiers or pseudonyms. Pseudonymization can help enhance the privacy of data by reducing the linkability between data and data subjects, but it does not prevent re-identification or inference attacks. Encryption is a process of transforming data into an unreadable form using a secret key or algorithm. Encryption can help protect the confidentiality, integrity, and availability of data by preventing unauthorized access, disclosure, or modification. Access control is a process of restricting who can access, modify, or delete data based on their roles, permissions, or credentials. Access control can help prevent unauthorized or inappropriate use of data by limiting the scope of access.

The primary means by which an organization communicates customer rights as it relates to the use of their personal information is publishing a privacy notice. A privacy notice is a document that informs the customers about how the organization collects, uses, shares, and protects their personal information, and what rights and choices they have regarding their data4. A privacy notice is a legal requirement under many data protection laws and regulations, such as the General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), or the Personal Information Protection and Electronic Documents Act (PIPEDA)5 . A privacy notice is also a good practice to demonstrate the organization’s commitment to transparency, accountability, and customer trust. References:

ISACA Glossary of Terms

Article 13 and 14 of the GDPR

[Section 1798.100 of the CCPA]

[Schedule 1, Principle 4.8 of the PIPEDA]

[ISACA CDPSE Review Manual, Chapter 1, Section 1.3.2]

Some organizations, typically those that manage large amounts of personal information related to employees, customers, or constituents, will employ a chief privacy officer (CPO). Some organizations have a CPO because applicable regulations such as the Gramm-Leach-Bliley Act (GLBA) require it. Other regulations such as the Health Information Portability and Accountability Act (HIPAA), the Fair Credit Reporting Act (FCRA), and the GLBA place a slate of responsibilities upon an organization that compels them to hire an executive responsible for overseeing compliance.

The chief privacy officer (CPO) is the senior executive who is responsible for establishing and maintaining the organization’s privacy vision, strategy, and program. The CPO oversees the development and implementation of privacy policies, procedures, standards, and controls, and ensures that they align with the organization’s business objectives and legal obligations. The CPO also leads the privacy governance structure, such as the privacy steering committee, and coordinates with other stakeholders, such as the chief data officer (CDO), the information security steering committee, and the legal counsel, to ensure that privacy is integrated into all aspects of the organization’s operations. References: : CDPSE Review Manual (Digital Version), page 21

An analysis of known threats is the best way for an organization to gain visibility into its exposure to privacy-related vulnerabilities because it helps identify the sources, methods and impacts of potential privacy breaches and assess the effectiveness of existing controls. A data loss prevention (DLP) solution, a review of historical privacy incidents and a monitoring of inbound and outbound communications are useful tools for detecting and preventing privacy violations, but they do not provide a comprehensive view of the organization’s privacy risk posture.

The first step toward the effective management of personal data assets is to create a personal data inventory, which is a comprehensive list of the personal data that an organization collects, processes, stores, transfers, and disposes of. A personal data inventory helps an organization to understand the types, sources, locations, owners, purposes, and retention periods of the personal data it holds, as well as the risks and obligations associated with them. A personal data inventory is essential for complying with data privacy laws and regulations, such as the GDPR or the PDPA, which require organizations to implement data protection principles and practices, such as obtaining consent, providing notice, ensuring data quality and security, respecting data subject rights, and reporting data breaches. A personal data inventory also helps an organization to identify and mitigate data privacy risks and gaps, and to implement data minimization and data security controls.

 Irreversible disposal is a process of removing or destroying data from a storage device or media to prevent unauthorized access or recovery of the data. Irreversible disposal is the most important thing to establish within a data storage policy to protect data privacy, as it reflects the principles of data minimization and storage limitation, which require limiting the collection, storage and processing of personal data to what is necessary and relevant for the intended purposes, and deleting or disposing of personal data when it is no longer needed or justified. Irreversible disposal also helps to reduce the privacy risks and costs associated with data storage and retention, such as data breaches, unauthorized access, misuse or loss of data. The other options are not as important as irreversible disposal in protecting data privacy within a data storage policy. Data redaction is a technique that removes or obscures sensitive or confidential information from a document or file, but it does not address the issue of data retention or deletion. Data quality assurance (QA) is a process of ensuring that the data meets the standards and specifications of accuracy, completeness, consistency and reliability, but it does not address the issue of data retention or deletion. Collection limitation is a principle that requires limiting the collection of personal data to what is necessary and relevant for the intended purposes, but it does not address the issue of data retention or deletion1, p. 75-76 References: 1: CDPSE Review Manual (Digital Version)

Restricting access to authorized users is the best control to secure application programming interfaces (APIs) that may contain personal information, as it would prevent unauthorized access, modification or disclosure of the personal information by third parties or intermediaries. Restricting access to authorized users can be achieved by using various methods, such as authentication, authorization, encryption, tokens or certificates. The other options are not effective controls to secure APIs that may contain personal information. Encrypting APIs with the organization’s private key is not a feasible or desirable method, as it would make the APIs unreadable by anyone who does not have the corresponding public key, which would defeat the purpose of using APIs for interoperability and integration. Requiring nondisclosure agreements (NDAs) when sharing APIs is not a reliable or enforceable method, as it would depend on the compliance and cooperation of the parties who receive the APIs, and it would not prevent unauthorized access, modification or disclosure of the personal information by third parties or intermediaries who are not bound by the NDAs. Sharing only digitally signed APIs is not a sufficient method, as it would only ensure the authenticity and integrity of the APIs, but it would not prevent unauthorized access, modification or disclosure of the personal information by third parties or intermediaries who can read or intercept the APIs1, p. 90-91 References: 1: CDPSE Review Manual (Digital Version)

Storing tokens of PII directly in database fields undermines the security of tokenization and risks re-identification, making it the most concerning issue. Shared drives (A) and lack of labels (B) are governance gaps, and limited third-party access (C) can be controlled contractually, but token misuse (D) poses direct privacy risk.

“Improper token storage can compromise de-identification, reintroducing privacy risk.”

The best way to safeguard the encryption keys is to ensure that they are stored in a cryptographic vault. A cryptographic vault is a secure hardware or software module that provides cryptographic services and protects the keys from unauthorized access, modification, or disclosure. A cryptographic vault can also provide other functions, such as key generation, key backup, key rotation, key destruction, and key auditing. A cryptographic vault can enhance the security and privacy of the encrypted data by preventing key compromise, leakage, or misuse. A cryptographic vault can also comply with the security standards and best practices for key management, such as the ISO/IEC 27002, NIST SP 800-57, or PCI DSS. References:

[ISACA Glossary of Terms]

[ISACA CDPSE Review Manual, Chapter 3, Section 3.3.3]

[ISACA Journal, Volume 4, 2019, “Key Management in the Multi-Cloud Environment”]

[ISACA CDPSE Review Manual, Chapter 3, Section 3.3.4]

The primary reason to complete a privacy impact assessment (PIA) is to understand privacy risks associated with the collection, use, disclosure or retention of personal data. A PIA is a systematic process to identify and evaluate the potential privacy impacts of a system, project, program or initiative that involves personal data processing activities. A PIA helps to ensure that privacy risks are identified and mitigated before the implementation is executed. A PIA also helps to ensure compliance with privacy principles, laws and regulations, and alignment with customer expectations and preferences. The other options are not primary reasons to complete a PIA. To comply with consumer regulatory requirements may be a reason to complete a PIA, but it is not the primary reason, as consumer regulatory requirements may vary depending on the context and jurisdiction. To establish privacy breach response procedures may be an outcome of completing a PIA, but it is not the primary reason, as privacy breach response procedures are only one aspect of mitigating privacy risks. To classify personal data may be an activity that is part of completing a PIA, but it is not the primary reason, as personal data classification is only one aspect of understanding privacy risks1, p. 67 References: 1: CDPSE Review Manual (Digital Version)

Before any processing, CDPSE stresses lawfulness: identify and document the appropriate legal basis and processing purpose(s). Security controls (C), algorithmic techniques (B), and aggregation (D) are important but secondary to establishing a lawful basis and purpose limitation.

Key CDPSE-aligned phrasing (short extract): “Processing requires a lawful basis and defined purposes prior to collection/use.”

Differential privacy provides mathematically provable protection against re-identification and linkage, adding calibrated noise to outputs so individuals cannot be singled out or linked. Pseudonymization (C) and masking (D) reduce direct identifiers but remain vulnerable to linkage attacks. Secure multiparty computation (B) protects computation among parties, not release-time linkability.

“Differential privacy limits what can be learned about any individual from query results, resisting re-identification/linkage.”

Sensitive personal data is a subset of personal data that reveals or relates to more intimate or confidential aspects of a person’s identity, such as their racial or ethnic origin, religious or philosophical beliefs, health status, sexual orientation, political opinions, trade union membership, biometric or genetic data, or criminal record. Sensitive personal data is subject to more stringent legal and regulatory protections and requires a higher level of consent from the data subject to be processed. Mailing address, bank account login ID, and contact phone number are examples of personal data, but not sensitive personal data, as they do not reveal or relate to such intimate or confidential aspects of a person’s identity.

Beacons use Bluetooth low-energy (BLE) wireless technology to transmit information to nearby devices that have Bluetooth enabled. By disabling Bluetooth services on the mobile device, the user can prevent beacons from detecting and tracking their location and sending them unwanted messages or advertisements. This can help protect the user’s privacy and avoid potential security risks from malicious beacons. Disabling location services, enabling Trojan scanners, or enabling antivirus for mobile devices are not effective ways to address threats to mobile device privacy when using beacons as a tracking technology, because they do not prevent the communication between beacons and the mobile device.

Following an established privacy framework is the most important step when developing an organizational data privacy program because it provides a structured and consistent approach to identify, assess, and manage privacy risks and compliance obligations. A privacy framework can also help to align the privacy program with the organization’s strategic goals, values, and culture, as well as to communicate and demonstrate the privacy program’s effectiveness to internal and external stakeholders. Some examples of established privacy frameworks are the NIST Privacy Framework, the ISO/IEC 27701:2019, and the AICPA Privacy Maturity Model.

Synthetic data generation is a recognized privacy-enhancing technology (PET) because it allows realistic model training and analysis without exposing actual personal data. PKI (A) provides authentication, not privacy preservation; blockchain (B) increases transparency but may conflict with privacy; identity management (D) supports security but is not a PET by itself.

“Synthetic data preserves patterns while removing identifiable personal information, enabling safe processing.”

A data dictionary is a document that defines and describes the data elements, attributes, formats, sources, destinations, purposes and relationships of a data set or system. A data dictionary would be the best way to ensure personal data usage is standardized across the entire organization, as it would provide a common and consistent understanding and reference for how personal data is collected, used, disclosed and transferred within and outside the organization. A data dictionary would also help to ensure compliance with privacy principles, such as accuracy, transparency and accountability. The other options are not as effective as developing a data dictionary in ensuring personal data usage is standardized across the entire organization. De-identify all data is a technique that removes or modifies direct and indirect identifiers in a data set to prevent or limit the identification of the data subjects, but it does not ensure standardization or consistency of personal data usage across the organization. Encrypt all sensitive data is a technique that transforms plain text data into cipher text using an algorithm and a key, making it unreadable by unauthorized parties, but it does not ensure standardization or consistency of personal data usage across the organization. Perform data discovery is a process of identifying and locating personal data within an organization’s systems, databases, applications or files, but it does not ensure standardization or consistency of personal data usage across the organization1, p. 69-70 References: 1: CDPSE Review Manual (Digital Version)

D. Requiring employees to review the organization’s privacy policy on an annual basis

Short Explanation: Requiring employees to review the organization’s privacy policy on an annual basis is the best activity to enable an organization to identify gaps in its privacy posture because it can help to ensure that the employees are aware of the current privacy requirements, expectations, and practices of the organization. It can also help to identify any discrepancies, inconsistencies, or conflicts between the policy and the actual implementation of privacy controls and processes. By reviewing the policy regularly, the organization can also update and improve it as needed to reflect any changes in the privacy landscape, such as new laws, regulations, standards, or threats.

The role primarily assigned to an internal data owner is authorizing access rights. A data owner is a person or a role within the organization who has the authority and responsibility for the data assets under their control. A data owner is responsible for defining the data classification, data quality, data retention, and data security requirements for their data assets. A data owner is also responsible for granting, revoking, and reviewing the access rights to their data assets based on the principle of least privilege and the business needs. A data owner is accountable for ensuring that the data assets are used in compliance with the organizational policies and the applicable laws and regulations. References:

[ISACA Glossary of Terms]

[ISACA CDPSE Review Manual, Chapter 3, Section 3.2.1]

[ISACA CDPSE Review Manual, Chapter 3, Section 3.2.2]

[ISACA CDPSE Review Manual, Chapter 3, Section 3.2.3]

A legal review is the most important thing to ensure before executive leadership approves a new data privacy policy, as it would help to verify and validate the accuracy, completeness and compliance of the policy with the applicable laws and regulations that govern the collection, use, disclosure and transfer of personal data. A legal review would also help to identify and address any gaps, inconsistencies or conflicts in the policy, and to provide legal advice or guidance on the implementation and enforcement of the policy. The other options are not as important as a legal review in ensuring before executive leadership approves a new data privacy policy. A training program is a method of educating and informing the employees and stakeholders about the new data privacy policy, its objectives, requirements and implications, but it does not ensure the quality or compliance of the policy itself. A privacy committee is a group of individuals who are responsible for overseeing, monitoring and evaluating the organization’s data privacy program, policies and practices, but it does not ensure the quality or compliance of the policy itself. A distribution methodology is a method of disseminating and communicating the new data privacy policy to the employees and stakeholders, such as email, intranet, website or newsletter, but it does not ensure the quality or compliance of the policy itself1, p. 98 References: 1: CDPSE Review Manual (Digital Version)

Ensuring appropriate data classification should be done next after a migration of personal data involving a data source with outdated documentation has been approved by senior management, as it helps to identify the types, locations, and owners of the data, and to apply the appropriate privacy controls and measures based on the data classification level. Data classification also facilitates the data discovery, data minimization, data retention, and data disposal processes15. References: 1 Domain 3, Task 2; 5 Page 9

Code review is a primary element of application and software hardening. Code review is a process of examining the source code of an application or software to identify and fix errors, vulnerabilities, or inefficiencies that may compromise its functionality, security, or performance. Code review can help prevent common security risks such as buffer overflows, SQL injections, cross-site scripting, or logic flaws. Code review can also help improve the quality, readability, maintainability, and usability of the code. Code review can be done manually by developers or peers, or automatically by tools such as static code analyzers or code quality checkers.

Vulnerability analysis, database configuration, and software repository are also important for application and software hardening, but they are not primary elements. Vulnerability analysis is a process of identifying and assessing the weaknesses or flaws in an application or software that may expose it to attacks or exploitation. Vulnerability analysis can be done by tools such as vulnerability scanners or penetration testers. Database configuration is a process of setting up and managing the parameters, options, or features of a database system that stores or processes data for an application or software. Database configuration can include aspects such as access control, encryption, backup, recovery, performance tuning, or replication. Software repository is a location where the source code, binaries, or documentation of an application or software are stored and managed. Software repository can facilitate version control, collaboration, distribution, or deployment of the application or software.

Requirements definition is a phase of the software development life cycle (SDLC) that involves gathering, analyzing and documenting the functional and non-functional requirements of the software system or application, such as features, performance, security and usability. It is most important to consider privacy by design principles during this phase, as it would help to ensure that privacy is embedded and integrated into the software system or application from the outset, rather than as an afterthought or an add-on. Considering privacy by design principles during requirements definition would also help to avoid costly rework or delays later in the SDLC, as well as to enhance customer trust and satisfaction, and comply with privacy laws and regulations. The other options are not as important as requirements definition in considering privacy by design principles. Application design is a phase of the SDLC that involves creating and specifying the architecture, components, interfaces and data models of the software system or application, based on the requirements defined in the previous phase. Implementation is a phase of the SDLC that involves coding, testing and debugging the software system or application, based on the design specifications created in the previous phase. Testing is a phase of the SDLC that involves verifying and validating that the software system or application meets the requirements and expectations of the users and stakeholders, as well as identifying and fixing any defects or errors1, p. 88-89 References: 1: CDPSE Review Manual (Digital Version)

A privacy notice is a document that informs data subjects about how their personal data is collected, processed, stored, shared, and protected by an organization. The primary purpose of a privacy notice is to provide transparency to the data subject on the intended use of their personal data, as well as their rights and choices regarding their data. A privacy notice also helps the organization comply with legal and regulatory requirements, such as obtaining consent, demonstrating accountability, and fulfilling the principle of fairness and lawfulness.

Attribute-based access control (ABAC) is the best approach for limiting the access of regional HR team members to employee data only within their regional office, because it allows for fine-grained and dynamic access control based on attributes of the subject, object, environment, and action. Attributes are characteristics or properties that can be used to describe or identify entities, such as users, resources, locations, roles, or permissions. ABAC uses policies and rules that evaluate the attributes and grant or deny access accordingly. For example, an ABAC policy could state that a user can access an employee record if and only if the user’s role is HR and the user’s region matches the employee’s region. This way, the access control can be tailored to the specific needs and context of the organization, without relying on predefined or fixed access levels.

The best testing method to identify and review the application’s runtime modules is dynamic application security testing (DAST). DAST is a testing technique that analyzes the application’s behavior and functionality during its execution. DAST can detect security and privacy vulnerabilities that are not visible in the source code, such as injection attacks, cross-site scripting, broken authentication, sensitive data exposure, or improper error handling. DAST can also simulate real-world attacks and test the application’s response and resilience. DAST can provide a comprehensive and realistic assessment of the application’s security and privacy posture in the pre-production environment. References:

[ISACA Glossary of Terms]

[OWASP Top 10 Web Application Security Risks]

[ISACA CDPSE Review Manual, Chapter 2, Section 2.4.2]

[ISACA Journal, Volume 6, 2018, “Dynamic Application Security Testing”]

Data minimization requires collecting and using only what is necessary for the stated purpose—directly limiting privacy risk in AI development and use. Encryption (A) and masking (D) protect data post-collection, and pseudonymization (B) reduces identifiability but does not limit collection or use. Minimization addresses privacy by default at the source.

“Collect and process no more personal data than necessary for the specified purpose.”

CDPSE/ISACA risk response taxonomy defines risk avoidance as deciding not to engage in the activity that gives rise to the risk. Reduction/mitigation (B/D) means proceed with controls; acceptance (C) means proceed without additional treatment. Not expanding is classic avoidance.

Key CDPSE-aligned phrasing (short extract): “Risk avoidance: Discontinue or do not initiate activities that create risk.”

Inferred data is the type of data that is produced by using a more complex method of analytics to find correlations between data sets and using them to categorize or profile people. Inferred data is not directly observed or collected from the data subjects, but rather derived from other sources of data, such as behavioral, transactional, or demographic data. Inferred data can be used to make assumptions or predictions about the data subjects’ preferences, interests, behaviors, or characteristics12.

Data classification is the process of categorizing data according to its sensitivity, value, and criticality for the organization and the data subjects. Data classification has the greatest impact on the treatment of data within the scope of an organization’s privacy policy, as it determines the appropriate level of protection, access, retention, and disposal for each type of data. Data classification also helps to comply with the privacy principles and regulations, such as data minimization, purpose limitation, accuracy, security, and accountability.

User behavior analytics tools are the best control to detect potential internal breaches of personal data because they monitor and analyze the activities and patterns of users on the network and systems, and alert or block any anomalous or suspicious behavior that may indicate unauthorized access, misuse or exfiltration of personal data. Data loss prevention (DLP) systems, employee background checks and classification of data are useful controls to prevent or mitigate internal breaches of personal data, but they do not necessarily detect them.

Senior leadership must define the roles and responsibilities of the person with oversight, who is responsible for ensuring compliance with the data privacy policy and applicable laws and regulations. This person may also be known as the data protection officer, the privacy officer, or the chief privacy officer, depending on the organization and jurisdiction. The person with oversight should have the authority, resources, and independence to perform their duties effectively.

The primary means by which an organization communicates customer rights as it relates to the use of their personal information is publishing a privacy notice. A privacy notice is a document that informs the customers about how their personal information is collected, used, shared, stored, and protected by the organization, as well as what rights they have regarding their personal information, such as access, rectification, erasure, portability, objection, etc. A privacy notice should be clear, concise, transparent, and easily accessible to the customers, and should comply with the applicable privacy regulations and standards. A privacy notice helps to establish trust and transparency between the organization and the customers, and enables the customers to exercise their rights and choices over their personal information. References: : CDPSE Review Manual (Digital Version), page 39

Pseudonymization is a technique that replaces direct identifiers in a data set with pseudonyms or artificial identifiers that do not reveal the identity of the data subjects. Pseudonymization reduces the linkability of the data set with the original identity of the data subjects and thus enhances the privacy and security of the data. However, pseudonymization is not irreversible and the original identity can be re-established if the pseudonym or key is compromised. Therefore, it is important to keep the identifier separate and distinct from the data it protects and to apply additional security measures to safeguard the identifier. The other options are not relevant to pseudonymization1, p. 74-75 References: 1: CDPSE Review Manual (Digital Version)

When contracting with a SaaS provider, it is important to ensure that the provider will remove all customer data from their systems and storage devices at the end of the service contract. This will prevent any unauthorized access, use, or disclosure of the customer data by the provider or third parties after the service termination. Removal of customer data means that the data are permanently erased and cannot be recovered or restored by any means.

The vulnerability that would have the greatest impact on the privacy of information is private key exposure, because it would compromise the encryption and decryption of the information, as well as the authentication and integrity of the communicating parties. A private key is a secret and unique value that is used to encrypt or decrypt data, or to sign or verify digital signatures. If an attacker gains access to the private key, they can read, modify, or impersonate the data or the sender, which would violate the confidentiality, integrity, and authenticity of the information12.

An audit log is a record of the activities and events that occur in an information system, such as an application hosting personal data. An audit log can help to monitor, detect, investigate and prevent unauthorized or malicious access, use, modification or deletion of personal data. An audit log can also help to demonstrate compliance with data protection laws and regulations, such as the General Data Protection Regulation (GDPR) or the California Consumer Privacy Act (CCPA). An audit log should capture the following information for each event: 9

The date and time of the event

The identity of the user or system that performed the event

The type and description of the event

The outcome or result of the event

The personal data that were accessed, used, modified or deleted

The last user who accessed personal data is the most important information to capture in the audit log, as it can help to identify who is responsible for any data breach or misuse of personal data. It can also help to verify that only authorized and legitimate users have access to personal data, and that they follow the data use policy and the principle of least privilege. The last user who accessed personal data can also help to support data subjects’ rights, such as the right to access, rectify, erase or restrict their personal data.

The other options are less important or irrelevant to capture in the audit log of an application hosting personal data. Server details of the hosting environment are not related to personal data, and they can be obtained from other sources, such as network logs or configuration files. Last logins of privileged users are important to capture in a separate audit log for user account management, but they do not indicate what personal data were accessed or used by those users. Application error events are important to capture in a separate audit log for system performance and reliability, but they do not indicate what personal data were affected by those errors.

Data masking is the process of hiding original data with modified content to protect sensitive data from unauthorized access or disclosure. Data masking is often used for testing purposes in non-production environments, where personal data is not needed or allowed. However, data masking can pose several challenges, especially for a global financial institution that has multiple interconnected systems and applications. One of the greatest challenges is to preserve the complex relationships within and across systems while masking the data. This means that the masked data must maintain the same format, referential integrity, semantic integrity, and uniqueness as the original data, so that the testing results are valid and reliable. For example, if a customer’s name is masked in one system, it must be masked consistently in all other systems that reference it. If a transaction amount is masked in one system, it must not violate any business rules or constraints in another system. If a credit card number is masked in one system, it must still be a valid credit card number in another system. Preserving these complex relationships can be challenging because it requires a thorough understanding of the data model, the business logic, and the dependencies among systems. It also requires a robust and flexible data masking tool that can handle different types of data and platforms.

A virtual private network (VPN) is a technology that creates a secure and encrypted connection over a public network, such as the internet. A VPN should be established first before authorizing remote access to a data store containing personal data, as it protects the data from unauthorized interception, modification, or disclosure by third parties. A VPN also helps to ensure the identity and authenticity of the remote users and devices accessing the data store. References: 2 Domain 2, Task 8

Sectoral is a privacy protection reference model that refers to a system of laws and regulations that apply to specific sectors or industries within a jurisdiction, such as health, finance, education or telecommunications. Sectoral privacy protection is typically characterized by having different rules and standards for different types of personal data or data processing activities, depending on the sensitivity and value of the data or the impact and risk of the processing. When a government’s health division established the complete privacy regulation for only the health market, it is using a sectoral privacy protection reference model, as it is addressing the specific needs and challenges of the health sector in terms of privacy protection. The other options are not applicable in this scenario. Co-regulatory is a privacy protection reference model that refers to a system of laws and regulations that are supplemented by self-regulation mechanisms, such as codes of conduct, standards or certification schemes, developed by industry associations or professional bodies with oversight from government agencies or regulators. Comprehensive is a privacy protection reference model that refers to a system of laws and regulations that apply to all sectors and industries within a jurisdiction, regardless of the type or nature of personal data or data processing activities. Self-regulatory is a privacy protection reference model that refers to a system of laws and regulations that rely on voluntary compliance by organizations with their own policies and procedures, without any external oversight or enforcement from government agencies or regulators1, p. 63-64 References: 1: CDPSE Review Manual (Digital Version)

The notice provided to customers during data collection is the most important consideration when determining retention periods for personal data, as it reflects the transparency and accountability principles of privacy and the expectations and preferences of the data subjects. The notice should inform the customers about the purposes and legal bases of the data processing, the rights and choices of the customers, and the safeguards and measures to protect the data, including how long the data will be kept and when it will be deleted or disposed of. The notice should also be consistent with the applicable laws and regulations that may prescribe or limit the retention periods for certain types of personal data. The other options are not as important as the notice provided to customers during data collection when determining retention periods for personal data. Sectoral best practices for the industry may provide some guidance or benchmarks for retention periods, but they may not reflect the specific context or needs of the organization or the customers. Data classification standards may help to categorize data according to its sensitivity and value, but they may not indicate how long the data should be retained or deleted. Storage capacity available for retained data may affect the feasibility or cost of retaining data, but it should not determine or override the retention periods based on privacy principles, laws or customer expectations1, p. 99-100 References: 1: CDPSE Review Manual (Digital Version)

A PIA is a systematic process to identify and evaluate the potential privacy impacts of a system, project, program or initiative that involves the collection, use, disclosure or retention of personal data. A PIA should be conducted as early as possible in the system lifecycle, preferably during the development stage, to ensure that privacy risks are identified and mitigated before the system is deployed. Conducting a PIA during functional testing, UAT or production stages may be too late to address privacy issues effectively and may result in costly rework or delays1, p. 67 References: 1: CDPSE Review Manual (Digital Version)

The best way for an organization to maintain the effectiveness of its privacy breach incident response plan is to conduct annual data privacy tabletop exercises. A tabletop exercise is a simulated scenario that tests the organization’s ability to respond to a privacy breach incident in a realistic and interactive way. A tabletop exercise can help the organization to evaluate the roles and responsibilities of the incident response team, identify the gaps and weaknesses in the plan, improve the communication and coordination among the stakeholders, and update the plan based on the lessons learned and best practices12. A tabletop exercise can also enhance the awareness and readiness of the organization to handle privacy breach incidents in a timely and effective manner3. References:

ISACA CDPSE Review Manual, Chapter 4, Section 4.3.2

ISACA Journal, Volume 4, 2019, “Tabletop Exercises: Three Sample Scenarios”

ISACA Journal, Volume 6, 2017, “Privacy Breach Response: Preparing for the Inevitable”

Incorporating privacy checkpoints into the secure development life cycle (SDLC) is the best way to avoid collecting personal data that was not part of the privacy impact assessment (PIA). Privacy checkpoints are stages in the SDLC where privacy requirements and risks are reviewed and validated, and any changes or deviations from the original PIA are identified and addressed. Privacy checkpoints help ensure that privacy is embedded throughout the system design and development, and that any changes are documented and approved.

Compartmentalizing resource access is a security technique that divides a system or network into separate segments or zones with different levels of access and control, based on the sensitivity and value of the data or resources. Compartmentalizing resource access would most effectively reduce the impact of a successful breach through a remote access solution, as it would limit the scope and extent of the breach, and prevent unauthorized access to other segments or zones that contain more critical or sensitive data or resources. The other options are not as effective as compartmentalizing resource access in reducing the impact of a successful breach through a remote access solution. Regular testing of system backups is a security technique that verifies the availability and recoverability of data in case of a system failure or disaster, but it does not prevent or limit unauthorized access to data. Monitoring and reviewing remote access logs is a security technique that records and analyzes the activities and events related to remote access sessions, but it does not prevent or limit unauthorized access to data. Regular physical and remote testing of the incident response plan is a security technique that evaluates and improves the readiness and effectiveness of an organization’s response to security incidents, but it does not prevent or limit unauthorized access to data1, p. 91-92 References: 1: CDPSE Review Manual (Digital Version)

The best way to validate compliance with agreed-upon service levels established with a third party that processes personal data is to have a contractual right to audit, which means that the organization can conduct audits or inspections of the third party’s privacy practices, policies, and procedures to verify that they meet the contractual obligations and expectations. A contractual right to audit can also help identify and address any privacy risks or gaps that may arise from the third party’s processing of personal data12.

Anonymization is a technique that removes or modifies all identifiers in a data set to prevent or limit the identification of the data subjects. Anonymization is the IT privacy practitioner’s best recommendation for an organization that uses analytics derived from archived transaction data to create individual customer profiles for customizing product and service offerings, as it would protect the privacy of the customers by reducing the linkability of the data set with their original identity, and also comply with the data minimization principle that requires limiting the collection, storage and processing of personal data to what is necessary and relevant for the intended purposes. Anonymization would also preserve some characteristics or patterns of the original data that can be used for analysis or customization purposes, without compromising the accuracy or quality of the results. The other options are not as effective as anonymization in this situation. Discontinuing the creation of profiles is not a feasible or desirable option, as it would prevent the organization from achieving its business objectives and providing value to its customers. Implementing strong access controls is a security measure that restricts who can access, view or modify the data, but it does not address the issue of collecting or retaining more personal data than necessary or relevant. Encrypting data at rest is a security measure that transforms plain text data into cipher text using an algorithm and a key, making it unreadable by unauthorized parties, but it does not address the issue of collecting or retaining more personal data than necessary or relevant, and may require additional security measures to protect the encryption keys or certificates1, p. 75-76 References: 1: CDPSE Review Manual (Digital Version)

 Including privacy requirements in vendor contracts is the best way to ensure privacy considerations are included when working with vendors because it establishes the obligations, expectations and responsibilities of both parties regarding the protection of personal data. It also provides a legal basis for enforcing compliance and resolving disputes. Including privacy requirements in the request for proposal (RFP) process, monitoring privacy-related service level agreements (SLAs) and requiring vendors to complete privacy awareness training are helpful measures, but they do not guarantee that vendors will adhere to the privacy requirements or that they will be held accountable for any violations.

A privacy impact assessment (PIA) is a systematic process to identify and evaluate the potential privacy impacts of a system, project, program or initiative that involves the collection, use, disclosure or retention of personal data. A PIA should be done first to address privacy risk when migrating customer relationship management (CRM) data to a new system, as it would help to ensure that privacy risks are identified and mitigated before the migration is executed. A PIA would also help to ensure compliance with privacy principles, laws and regulations, and alignment with customer expectations and preferences. The other options are not as important as performing a PIA when addressing privacy risk when migrating CRM data to a new system. Developing a data migration plan is a process of defining and documenting the objectives, scope, approach, methods and steps for transferring data from one system to another, but it does not necessarily address privacy risk or impact. Conducting a legitimate interest analysis (LIA) is a process of assessing whether there is a legitimate interest for processing personal data that outweighs the rights and interests of the data subjects, but it is only applicable in certain jurisdictions and situations where legitimate interest is a valid legal basis for processing. Obtaining consent from data subjects is a process of obtaining their permission or agreement before collecting, using, disclosing or transferring their personal data for specific purposes, but it may not be required or sufficient for migrating CRM data to a new system, depending on the context and nature of the migration and the applicable laws and regulations1, p. 67 References: 1: CDPSE Review Manual (Digital Version)

The answer is B. Personal data could potentially be exfiltrated through the virtual workspace.

A comprehensive explanation is:

A virtualized workspace is a cloud-based service that provides remote access to a desktop environment, applications, and data. A virtualized workspace can enable software development teams to collaborate and work efficiently across different locations and devices. However, a virtualized workspace also poses significant privacy risks, especially when it is implemented by a third-party provider.

One of the greatest privacy concerns of using a third-party virtualized workspace is the potential for personal data to be exfiltrated through the virtual workspace. Personal data is any information that relates to an identified or identifiable individual, such as name, email, address, phone number, etc. Personal data can be collected, stored, processed, or transmitted by the software development organization or its clients, partners, or users. Personal data can also be generated or inferred by the software development activities or products.

Personal data can be exfiltrated through the virtual workspace by various means, such as:

Data breaches: A data breach is an unauthorized or unlawful access to or disclosure of personal data. A data breach can occur due to weak security measures, misconfiguration errors, human errors, malicious attacks, or insider threats. A data breach can expose personal data to hackers, competitors, regulators, or other parties who may use it for harmful purposes.

Data leakage: Data leakage is an unintentional or accidental transfer of personal data outside the intended boundaries of the organization or the virtual workspace. Data leakage can occur due to improper disposal of devices or media, insecure network connections, unencrypted data transfers, unauthorized file sharing, or careless user behavior. Data leakage can compromise personal data to third parties who may not have adequate privacy policies or practices.

Data mining: Data mining is the analysis of large and complex data sets to discover patterns, trends, or insights. Data mining can be performed by the third-party provider of the virtual workspace or by other authorized or unauthorized parties who have access to the virtual workspace. Data mining can reveal personal data that was not explicitly provided or intended by the organization or the individuals.

The exfiltration of personal data through the virtual workspace can have serious consequences for the software development organization and its stakeholders. It can result in:

Legal liability: The organization may face legal actions or penalties for violating the privacy laws, regulations, standards, or contracts that apply to the personal data in each jurisdiction where it operates or serves. For example, the General Data Protection Regulation (GDPR) in the European Union imposes strict obligations and sanctions for protecting personal data across borders.

Reputational damage: The organization may lose trust and credibility among its clients, partners, users, employees, investors, or regulators for failing to safeguard personal data. This can affect its brand image, customer loyalty, market share, revenue, or growth potential.

Competitive disadvantage: The organization may lose its competitive edge or intellectual property if its personal data is stolen or misused by its rivals or adversaries. This can affect its innovation capability, product quality, or market differentiation.

Therefore, it is essential for the software development organization to implement appropriate measures and controls to prevent or mitigate the exfiltration of personal data through the virtual workspace. Some of these measures and controls are:

Data minimization: The organization should collect and process only the minimum amount and type of personal data that is necessary and relevant for its legitimate purposes. It should also delete or anonymize personal data when it is no longer needed or required.

Data encryption: The organization should encrypt personal data at rest and in transit using strong and standardized algorithms and keys. It should also ensure that only authorized parties have access to the keys and that they are stored securely.

Data segmentation: The organization should segregate personal data into different categories based on their sensitivity and risk level. It should also apply different levels of protection and access control to each category of personal data.

Data governance: The organization should establish a clear and comprehensive policy and framework for managing personal data throughout its lifecycle. It should also assign roles and responsibilities for implementing and enforcing the policy and framework.

Data audit: The organization should monitor and review the activities and events related to personal data on a regular basis. It should also conduct periodic assessments and tests to evaluate the effectiveness and compliance of its privacy measures and controls.

Data awareness: The organization should educate and train its staff and users on the importance and best practices of protecting personal data. It should also communicate and inform its clients, partners, and regulators about its privacy policies and practices.

The other options are not as great of a concern as option B.

The third-party workspace being hosted in a highly regulated jurisdiction (A) may pose some challenges for complying with different privacy laws and regulations across borders. However it may also offer some benefits such as higher standards of privacy protection and enforcement.

The organization’s products being classified as intellectual property © may increase the value and attractiveness of the personal data related to the products, but it does not necessarily increase the risk of exfiltration of the personal data through the virtual workspace.

The lack of privacy awareness and training among remote personnel (D) may increase the likelihood of human errors or negligence that could lead to exfiltration of personal data through the virtual workspace. However it is not a direct cause or source of exfiltration, and it can be addressed by providing adequate education and training.

A thin client remote desktop protocol (RDP) is the most effective remote access model for reducing the likelihood of attacks originating from connecting devices, because it minimizes the amount of data and processing that occurs on the remote device. A thin client RDP only sends keyboard, mouse and display information between the remote device and the server, while the actual processing and storage of data happens on the server. This reduces the exposure of sensitive data and applications to potential attackers who may compromise the remote device.

A retention schedule is a document that specifies how long different types of records or data should be kept and when they should be deleted or disposed of, based on legal, regulatory, operational or historical requirements. A retention schedule is the best indication of an effective records management program for personal data, as it reflects the principles of data minimization and storage limitation, which require limiting the collection, storage and processing of personal data to what is necessary and relevant for the intended purposes, and deleting or disposing of personal data when it is no longer needed or justified. A retention schedule also helps to reduce the privacy risks and costs associated with data storage and retention, such as data breaches, unauthorized access, misuse or loss of data. The other options are not as indicative of an effective records management program for personal data as a retention schedule. Archived data is used for future analytics may indicate that the organization is leveraging its data assets for business intelligence or research purposes, but it may not comply with the principles of data minimization and storage limitation, or the privacy rights and preferences of the data subjects. The legal department has approved the retention policy may indicate that the organization has obtained legal advice or guidance on its records management program for personal data, but it may not reflect the actual implementation or execution of the retention policy. All sensitive data has been tagged may indicate that the organization has implemented a data classification scheme for its records or data, but it may not indicate how long the records or data should be kept or when they should be deleted or disposed of1, p. 99-100 References: 1: CDPSE Review Manual (Digital Version)

Performing a full wipe and reimage of the laptops is the best control to prevent the exposure of personal information when redeploying laptops within an organization. This is because a full wipe and reimage ensures that all data, including personal information, is securely erased from the laptops and replaced with a fresh installation of the operating system and applications. This reduces the risk of data leakage, unauthorized access, or data recovery by malicious actors or unauthorized users. The other options are not as effective or sufficient as a full wipe and reimage, as they do not guarantee the complete removal of personal information from the laptops.

Encryption of network traffic is the most important control to mitigate the risk of potential personal data compromise when employees access corporate IT assets remotely. Encryption is a process that transforms data into an unreadable form, making it difficult for unauthorized parties to intercept, modify, or steal it. Encryption of network traffic ensures that the data transmitted between the remote employees and the corporate network is protected from eavesdropping, tampering, or leakage.

Intrusion prevention system (IPS), firewall rules review, and intrusion detection system (IDS) are also useful controls for network security, but they are not as effective as encryption for protecting personal data in transit. IPS and IDS can monitor and block malicious or suspicious network traffic, but they cannot prevent data exposure if the traffic is intercepted by a third party. Firewall rules review can help optimize and secure the firewall configuration, but it cannot guarantee that the firewall will not be bypassed or compromised by an attacker. Therefore, encryption of network traffic is the best option among the choices given.

Data privacy standards are the set of rules, guidelines, and best practices that define the requirements and expectations for the collection, processing, storage, sharing, and disposal of personal data. Data privacy standards help to ensure that personal data is treated in a fair, lawful, transparent, and secure manner, as well as to comply with the applicable privacy laws and regulations. Data privacy standards also help to define the data retention time in a stream-fed data lake that includes personal data, as they specify the criteria and conditions for how long personal data can be kept in the data lake, based on factors such as the purpose, necessity, relevance, and quality of the data. Data retention time is an important aspect of data privacy, as it affects the risk of data breaches, unauthorized access, or misuse of personal data.