IAPP Updated CIPM Exam Questions and Answers by dawud

“Respond” in the privacy operational lifecycle includes information requests and privacy rights requests, which are requests from individuals or authorities to access, correct, delete, or restrict the processing of personal data. The privacy program must have processes and procedures to handle such requests in a timely and compliant manner. The other options are not part of the “respond” phase, but rather belong to other phases such as “protect”, “aware”, or “align”. References: CIPM Body of Knowledge, Domain III: Privacy Program Operational Life Cycle, Section D: Respond.

The statement that is false regarding the use of technical security controls is that most privacy legislation lists the types of technical security controls that must be implemented. Technical security controls are the hardware and software components that protect a system against cyberattacks, such as encryption, firewalls, antivirus software, and access control mechanisms1 However, most privacy legislation does not prescribe specific types of technical security controls that must be implemented by organizations. Instead, they usually require organizations to implement reasonable or appropriate technical security measures to protect personal data from unauthorized or unlawful access, use, disclosure, alteration, or destruction23 The exact level and type of technical security controls may depend on various factors, such as the nature and sensitivity of the data, the risks and threats involved, the state of the art technology available, and the cost and feasibility of implementation4 Therefore, organizations have some flexibility and discretion in choosing the most suitable technical security controls for their data processing activities. References: 1: Technical Controls — Cybersecurity Resilience - Resilient Energy Platform; 2: [General Data Protection Regulation (GDPR) – Official Legal Text], Article 32; 3: [Privacy Act 1988], Schedule 1 - Australian Privacy Principles (APPs), APP 11; 4: Technical Security Controls: Encryption, Firewalls & More

Distributing a phishing exercise to all employees is not advisable to do if your organization has a recurring issue with colleagues not reporting personal data breaches. A phishing exercise is a simulated attack that tests the awareness and response of employees to malicious emails that attempt to obtain sensitive information or compromise systems. While phishing exercises can be useful to train employees on how to recognize and avoid phishing attacks, they are not directly related to the issue of reporting personal data breaches. The other options are more appropriate to address the root cause of the issue, communicate the expectations and procedures for reporting breaches, and provide specific training to areas where breaches are happening1, 2. References: CIPM - International Association of Privacy Professionals, Free CIPM Study Guide - International Association of Privacy Professionals