Question 1 of 10 · Privacy Program: Developing a Framework
Why integrate privacy risk into enterprise risk management?
Integration puts privacy on the same scale as other risks, informing priorities and resourcing. It does not remove the privacy team's role, hide risk or hand privacy entirely to another team.
Question 2 of 10 · Privacy Program: Establishing Program Governance
How should the privacy program report to senior leadership?
Regular reporting with risks, metrics and asks keeps leadership informed and engaged.
Question 3 of 10 · Privacy Program Operational Life Cycle: Assessing Data
What should a DPIA do if high risk remains after mitigation?
Under Article 36, if high residual risk remains, the controller consults the supervisory authority before processing.
Question 4 of 10 · Privacy Program Operational Life Cycle: Protecting Personal Data
What does encryption protect against in a lost laptop scenario?
Encryption at rest keeps data unreadable without the key; it does not prevent loss.
Question 5 of 10 · Privacy Program Operational Life Cycle: Sustaining Program Performance
Which is a first-party privacy audit?
First-party audits are internal; second-party audits are by customers or partners; third-party audits are by independent bodies such as certifiers. Regulatory inspections are separate.
Question 6 of 10 · Privacy Program Operational Life Cycle: Responding to Requests and Incidents
A request arrives from a California resident and an EU resident on the same day. How should deadlines be managed?
Each law sets its own timing, such as one month under the GDPR and 45 days under the CCPA, so tracking per request avoids breaches. Uniform choices can work but must not breach any applicable deadline.
Question 7 of 10 · Privacy Program: Developing a Framework
Which is the purpose of a gap assessment against a framework?
A gap assessment compares current practices with requirements to prioritize work. It does not certify compliance.
Question 8 of 10 · Privacy Program: Establishing Program Governance
What should happen when an employee repeatedly breaches privacy policy?
Policies only work if breaches have known, consistent consequences, so repeated violations should go through the organization's disciplinary process, coordinated with HR. Repeating warnings without escalation signals that the policy is optional. Referring an employee to the regulator is not the internal response the program owns, and naming the employee publicly raises its own privacy and legal problems.
Question 9 of 10 · Privacy Program Operational Life Cycle: Assessing Data
What is inherent privacy risk?
Inherent risk is the level before controls; residual risk is what remains after them. Acceptance and transfer are risk treatment choices.
Question 10 of 10 · Privacy Program Operational Life Cycle: Protecting Personal Data
How should consent be managed in systems?
Where consent is the legal basis, the organization must be able to show what each person agreed to, when and how, and must act on withdrawal across systems as easily as consent was given. Continued use of a website after a notice is not valid consent under laws such as the GDPR. Consent may need refreshing when purposes change, and paper-only records are hard to honor across digital systems.
0 of 10
Privacy Program: Developing a Framework
Privacy Program: Establishing Program Governance
Privacy Program Operational Life Cycle: Assessing Data
Privacy Program Operational Life Cycle: Protecting Personal Data
Privacy Program Operational Life Cycle: Sustaining Program Performance
Privacy Program Operational Life Cycle: Responding to Requests and Incidents
Which domains cost you the points? Members see a breakdown by domain and a study plan built from it.