Question 1 of 10 · Privacy Program: Developing a Framework
Why integrate privacy risk into enterprise risk management?
Integration puts privacy on the same scale as other risks, informing priorities and resourcing. It does not remove the privacy team's role, hide risk or hand privacy entirely to another team.
Question 2 of 10 · Privacy Program: Establishing Program Governance
How should the privacy program report to senior leadership?
Regular reporting with risks, metrics and asks keeps leadership informed and engaged.
Question 3 of 10 · Privacy Program Operational Life Cycle: Assessing Data
What should a DPIA do if high risk remains after mitigation?
Under Article 36, if high residual risk remains, the controller consults the supervisory authority before processing.
Question 4 of 10 · Privacy Program Operational Life Cycle: Protecting Personal Data
What does encryption protect against in a lost laptop scenario?
Encryption at rest keeps data unreadable without the key; it does not prevent loss.
Question 5 of 10 · Privacy Program Operational Life Cycle: Sustaining Program Performance
Which is a first-party privacy audit?
First-party audits are internal; second-party audits are by customers or partners; third-party audits are by independent bodies such as certifiers. Regulatory inspections are separate.
Question 6 of 10 · Privacy Program Operational Life Cycle: Responding to Requests and Incidents
A request arrives from a California resident and an EU resident on the same day. How should deadlines be managed?
Each law sets its own timing, such as one month under the GDPR and 45 days under the CCPA, so tracking per request avoids breaches. Uniform choices can work but must not breach any applicable deadline.
Question 7 of 10 · Privacy Program: Developing a Framework
Which is the purpose of a gap assessment against a framework?
A gap assessment compares current practices with requirements to prioritize work. It does not certify compliance.
Question 8 of 10 · Privacy Program: Establishing Program Governance
What should happen when an employee repeatedly breaches privacy policy?
Policies need consistent consequences; regulator referral and public disclosure are not appropriate internal responses.
Question 9 of 10 · Privacy Program Operational Life Cycle: Assessing Data
What is inherent privacy risk?
Inherent risk is the level before controls; residual risk is what remains after them. Acceptance and transfer are risk treatment choices.
Question 10 of 10 · Privacy Program Operational Life Cycle: Protecting Personal Data
How should consent be managed in systems?
Valid consent must be recorded and withdrawal honored.
0 of 10
Privacy Program: Developing a Framework
Privacy Program: Establishing Program Governance
Privacy Program Operational Life Cycle: Assessing Data
Privacy Program Operational Life Cycle: Protecting Personal Data
Privacy Program Operational Life Cycle: Sustaining Program Performance
Privacy Program Operational Life Cycle: Responding to Requests and Incidents
Which domains cost you the points? Members see a breakdown by domain and a study plan built from it.