Try 12 free IAPP CIPT practice questions

Answer: B. When a privacy technologist first consults on privacy policies, the foundational step is to understand the organization's specific risk profile: what data the organization processes, who is affected, what its regulatory environment is, and what its threat landscape looks like. This risk profile determines which principles and requirements are most relevant and how rigorously they must be implemented. Generic best practices cannot be applied without first understanding the specific context.

• A: Aligning with industry best practices is a subsequent step that follows from understanding the organization's risk profile; without context, best practice alignment may be misapplied or incomplete.
• C: Engaging external stakeholders (regulators, partners) is appropriate once internal needs are understood; it should not precede the internal risk assessment.
• D: Requiring senior leadership review is a governance step that follows the policy development process, not the first step in consulting on policies.

Answer: C. Under GDPR Article 30(2), when an organization processes data as a processor on behalf of another organization (the controller), the required elements of its Records of Processing Activities (RoPA) are: the name and contact details of the processor and its representative, plus the DPO; the categories of processing carried out on behalf of each controller; where applicable, transfers to third countries and the safeguards used; and where possible, a general description of security measures. Contact details of the processor and DPO are explicitly mandatory for processor RoPA entries.

• A: Copies of consent forms are a controller's obligation to demonstrate a lawful basis; a processor RoPA does not require them.
• B: Time limits for erasure are listed as a requirement for controllers under Article 30(1), not for processors under Article 30(2), which has a more limited set of mandatory fields.
• D: Descriptions of processing activities and data subjects are required in the controller's RoPA under Article 30(1)(c) and (d), not in the processor's Article 30(2) entry.

Answer: A. The OECD Individual Participation Principle gives individuals rights to inquire whether an organization holds their data, to have it communicated to them, to challenge it, and crucially to have it erased or corrected. Consent before transfer flows from the individual's right to control how their personal information is used and shared, both elements of individual participation. No other OECD principle directly grants individuals a voice in transfer decisions.

• B: Purpose Specification requires that the purposes of collection be stated at the time of collection; it does not address individual consent to transfers.
• C: Collection Limitation restricts how data is gathered (consent/lawful means, limited to what is necessary); it does not govern subsequent transfers.
• D: Accountability places responsibility on the data controller to comply with the principles; it does not confer rights on the individual regarding transfers.