Free CDPSE sample questions

Correct answer: Federated Learning, to train a shared global model by sending model updates from each bank instead of raw data.

Federated Learning is the ideal solution here. It allows a central model to be trained collaboratively without any of the participating organizations having to expose their raw, sensitive data. Each bank trains a local version of the model on its own data, and only the resulting model weights or updates are sent to a central server for aggregation. This directly addresses the core constraint of not sharing raw data while still enabling the creation of a highly accurate, shared model.

Correct answer: Form a cross-functional privacy committee and assign clear privacy responsibilities to existing roles.

For a rapidly scaling startup with a flat structure, the most effective first step is to embed privacy responsibility within the existing organization. Forming a cross-functional committee (involving engineering, product, legal, marketing) and assigning clear privacy champion roles ensures that privacy is integrated into the company's agile culture from the ground up. This approach is more practical and sustainable than immediately imposing a rigid external structure or focusing solely on tools or documentation without clear ownership.

Correct answers: An automated script that queries for eligible records and triggers a cryptographic erasure process.; Immutable audit logging that records every deletion event, including the record ID, timestamp, and justification.

Automation is crucial for reliably enforcing a retention schedule at scale. A script that identifies records meeting the deletion criteria (e.g., last interaction date > 7 years) and triggers a secure deletion method like cryptographic erasure is a core technical control.

To prove compliance and maintain accountability, it is essential to have a secure, tamper-proof log of all data destruction activities. This log serves as evidence that the retention policy is being followed correctly and provides a trail for any future audits or investigations.

Correct answer: The processing is likely to result in a high risk to the rights and freedoms of individuals.

Under Article 35 of the GDPR, a DPIA is required when a type of processing, particularly using new technologies, is likely to result in a high risk to the rights and freedoms of natural persons. The large-scale processing of special category data (biometrics from faces), combined with location data and innovative use of technology (ML), clearly meets this threshold.

Correct answer: Implement a microservices architecture where separate, containerized services handle each data type. Store each data type in its own purpose-built, independently secured database, and use an API Gateway with fine-grained access controls to manage data flow.

This approach is the strongest example of Privacy by Design. A microservices architecture inherently promotes data segregation and purpose limitation, as each service only handles the data it needs. Storing data in separate, purpose-built databases (e.g., a time-series DB for biometrics, a document store for chat logs) allows for tailored security controls. The API Gateway acts as a central policy enforcement point, ensuring that only authorized services can access specific data types, thus enforcing the principle of least privilege and data minimization.

Correct answer: False

This is false. The GDPR explicitly defines pseudonymization and considers pseudonymized data to still be personal data, as it can be re-identified with additional information. While pseudonymization is a recommended security measure that can reduce risks and help meet data protection principles, it does not remove the data from the scope of the regulation. Anonymized data, in contrast, is outside the scope of the GDPR.

Correct answer: The right to audit clause.

The right to audit clause is the most critical contractual tool in this scenario. It grants the data controller (the e-commerce company) the authority to inspect and verify the data processor's (the cloud provider's) compliance with the DPA. This clause provides the legal basis to demand evidence, conduct an audit of the provider's storage locations, and enforce remediation for the contractual breach.

Correct answer: The automated data discovery and retrieval tools are failing to locate personal data across all systems.

The combination of increased completion time and a tripling of manual legal interventions strongly points to a failure in the underlying automation. When automated tools cannot find or collate a subject's data from the various production and legacy systems, the process breaks down. This forces manual searches and requires legal review to ensure completeness and handle exceptions, which perfectly explains the observed metrics.

Correct answers: Verifying explicitly: Always authenticate and authorize based on all available data points.; Using least privilege access: Limit user access with just-in-time and just-enough-access (JIT/JEA).; Assuming breach: Minimize blast radius for breaches and prevent lateral movement.

This is a foundational principle of zero trust. Every access request is treated as if it originates from an untrusted network, requiring rigorous verification each time.

Another core tenet of zero trust is to grant the minimum level of access needed for a task, for the shortest time possible, to minimize the potential impact of a compromised account.

Zero trust architecture operates on the assumption that a breach is inevitable or has already occurred. Technologies like micro-segmentation are used to create granular zones and policies that prevent an attacker from moving freely within the network.

Correct answer: Establish and receive approval for Binding Corporate Rules (BCRs) from a lead EU data protection authority.

For intra-group transfers within a multinational corporation, Binding Corporate Rules (BCRs) are considered the 'gold standard'. While more complex and time-consuming to establish than SCCs, they represent a comprehensive, approved framework for data protection across the entire corporate group. Once approved by a data protection authority, they provide a very strong legal basis for recurring, systematic transfers like payroll processing.