CDPSE Certified Data Privacy Solutions Engineer Questions and Answers

The best approach for handling personal data that has been restricted is to flag users’ email addresses to make sure they do not receive promotional information, because this will respect the users’ preferences and rights to opt out of marketing communications. This will also help the company comply with the data protection laws and regulations that require consent and transparency for sending marketing emails, such as the General Data Protection Regulation (GDPR) and the CAN-SPAM Act12. The other options are not appropriate or sufficient for handling restricted data, because they may violate the users’ rights, expectations, or agreements, or cause operational issues for the company.

References:

• CDPSE Review Manual, Chapter 3 – Data Lifecycle, Section 3.1 – Data Classification3.
• CDPSE Certified Data Privacy Solutions Engineer All-in-One Exam Guide, Chapter 3 – Data Lifecycle, Section 3.2 – Data Classification4.

A retention schedule is a document that specifies how long different types of records or data should be kept and when they should be deleted or disposed of, based on legal, regulatory, operational or historical requirements. A retention schedule is the best indication of an effective records management program for personal data, as it reflects the principles of data minimization and storage limitation, which require limiting the collection, storage and processing of personal data to what is necessary and relevant for the intended purposes, and deleting or disposing of personal data when it is no longer needed or justified. A retention schedule also helps to reduce the privacy risks and costs associated with data storage and retention, such as data breaches, unauthorized access, misuse or loss of data. The other options are not as indicative of an effective records management program for personal data as a retention schedule. Archived data is used for future analytics may indicate that the organization is leveraging its data assets for business intelligence or research purposes, but it may not comply with the principles of data minimization and storage limitation, or the privacy rights and preferences of the data subjects. The legal department has approved the retention policy may indicate that the organization has obtained legal advice or guidance on its records management program for personal data, but it may not reflect the actual implementation or execution of the retention policy. All sensitive data has been tagged may indicate that the organization has implemented a data classification scheme for its records or data, but it may not indicate how long the records or data should be kept or when they should be deleted or disposed of1, p. 99-100 References: 1: CDPSE Review Manual (Digital Version)

Pseudonymization is a technique that replaces or removes direct identifiers from personal data, such as names, addresses, or social security numbers, with pseudonyms, such as codes, tokens, or random values. However, pseudonymization does not eliminate the possibility of re-identification, as the original data can still be linked back to the pseudonyms using additional information or techniques. Therefore, if a database containing pseudonymized personal data is breached, the IT privacy practitioner should be most concerned about the risk of re-identification, which could compromise the privacy and security of the data subjects. The other options are less relevant or important than the risk of re-identification.

References: CDPSE Review Manual, 2021, p. 62

When contracting with a SaaS provider, it is important to ensure that the provider will remove all customer data from their systems and storage devices at the end of the service contract. This will prevent any unauthorized access, use, or disclosure of the customer data by the provider or third parties after the service termination. Removal of customer data means that the data are permanently erased and cannot be recovered or restored by any means.

References:

• ISACA, Data Privacy Audit/Assurance Program, Control Objective 9: Data Disposal, p. 16-171
• ISACA, CDPSE Review Manual 2021, Chapter 4: Privacy Incident Response, Section 4.2: Data Disposal and Destruction, p. 151-152.

The best way to ensure an organization’s enterprise risk management (ERM) framework can protect the organization from privacy harms is to complete a privacy risk assessment. A privacy risk assessment is a systematic process of identifying, analyzing, evaluating, and treating the privacy risks that may affect the organization’s objectives, operations, stakeholders, and reputation. A privacy risk assessment helps to align the ERM framework with the privacy requirements, expectations, and obligations of the organization, as well as to prioritize and mitigate the privacy risks that may cause privacy harms. Privacy harms are the adverse consequences or impacts that may result from the unauthorized or inappropriate use, disclosure, or loss of personal data, such as financial loss, identity theft, discrimination, reputational damage, emotional distress, or physical harm.

References: CDPSE Review Manual, 2021, p. 84

Senior leadership must define the roles and responsibilities of the person with oversight, who is responsible for ensuring compliance with the data privacy policy and applicable laws and regulations. This person may also be known as the data protection officer, the privacy officer, or the chief privacy officer, depending on the organization and jurisdiction. The person with oversight should have the authority, resources, and independence to perform their duties effectively.

References:

• ISACA, CDPSE Review Manual 2021, Chapter 2: Privacy Governance, Section 2.1: Privacy Governance Framework, p. 35-36.
• ISACA, Data Privacy Audit/Assurance Program, Control Objective 1: Data Privacy Governance, p. 4-51

A legal review is the most important thing to ensure before executive leadership approves a new data privacy policy, as it would help to verify and validate the accuracy, completeness and compliance of the policy with the applicable laws and regulations that govern the collection, use, disclosure and transfer of personal data. A legal review would also help to identify and address any gaps, inconsistencies or conflicts in the policy, and to provide legal advice or guidance on the implementation and enforcement of the policy. The other options are not as important as a legal review in ensuring before executive leadership approves a new data privacy policy. A training program is a method of educating and informing the employees and stakeholders about the new data privacy policy, its objectives, requirements and implications, but it does not ensure the quality or compliance of the policy itself. A privacy committee is a group of individuals who are responsible for overseeing, monitoring and evaluating the organization’s data privacy program, policies and practices, but it does not ensure the quality or compliance of the policy itself. A distribution methodology is a method of disseminating and communicating the new data privacy policy to the employees and stakeholders, such as email, intranet, website or newsletter, but it does not ensure the quality or compliance of the policy itself1, p. 98 References: 1: CDPSE Review Manual (Digital Version)

Endpoint encryption is a security practice that transforms the data stored on a laptop or other device into an unreadable format using a secret key or algorithm. Endpoint encryption protects the privacy of data in case of loss or theft, by ensuring that only authorized parties can access and use the data, while unauthorized parties cannot decipher or modify the data without the key or algorithm. Endpoint encryption also helps to comply with data protection laws and regulations, such as the General Data Protection Regulation (GDPR) or the California Consumer Privacy Act (CCPA), which require data controllers and processors to implement appropriate technical and organizational measures to safeguard personal data.

The other options are less effective or irrelevant for protecting the privacy of data stored on a laptop in case of loss or theft. Strong authentication controls, such as passwords, biometrics or multifactor authentication, are important for verifying the identity and access rights of users, but they do not protect the data from being accessed by bypassing or breaking the authentication mechanisms. Remote wipe is a feature that allows users or administrators to erase the data on a lost or stolen device remotely, but it depends on the availability of network connection and device power, and it may not prevent data recovery by sophisticated tools. Regular backups are a process of creating copies of data for recovery purposes, such as in case of data loss or corruption, but they do not protect the data from being accessed by unauthorized parties who may obtain the backup media or files.

References:

• An Ethical Approach to Data Privacy Protection - ISACA, section 2: “Encryption is one of the most effective security controls available to enterprises, but it can be challenging to deploy and maintain across a complex enterprise landscape.”
• How to Protect and Secure Your Data in 10 Ways - TechRepublic, section 1: “Encrypt your hard drive Most work laptops use BitLocker to encrypt local files. That way, if the computer is stolen or hacked, the data it contains will be useless to the malicious actor.”
• 10 Tips to Protect Your Files on PC and Cloud - microsoft.com, section 1: “Encrypt your hard drive Most work laptops use BitLocker to encrypt local files. That way, if the computer is stolen or hacked, the data it contains will be useless to the malicious actor.”
• 11 practical ways to keep your IT systems safe and secure | ICO, section 1: “Use strong passwords and multi-factor authentication Make sure you use strong passwords on smartphones, laptops, tablets, email accounts and any other devices or accounts where personal information is stored.”

Data flows are the most important to review before using an application programming interface (API) to help mitigate related privacy risk. Data flows are the paths or routes that data take from their sources to their destinations through various processes, transformations, or exchanges. Data flows can help understand how data are collected, used, shared, stored, or deleted by an API and its related applications. Data flows can also help identify the potential privacy risks or impacts that may arise from data processing activities involving an API and its related applications. Data flows can be represented by diagrams, maps, models, or documents that show the sources, destinations, types, formats, volumes, frequencies, purposes, or legal bases of data.

Data taxonomy, data classification, and data collection are also important for privacy risk mitigation when using an API, but they are not the most important. Data taxonomy is a system of organizing and categorizing data into groups, classes, or hierarchies based on their characteristics, attributes, or relationships. Data taxonomy can help understand the structure, meaning, context, or value of data. Data classification is a process of assigning labels or tags to data based on their sensitivity, confidentiality, criticality, or risk level. Data classification can help determine the appropriate level of protection or handling for data. Data collection is a process of gathering or obtaining data from various sources for a specific purpose or objective. Data collection can help obtain the necessary information or evidence for decision making or problem solving.

References: Critical API security risks: 10 best practices | TechBeacon, Open APIs and Security Risks | Govenda Board Portal Software, The top API security risks and how to mitigate them - Appinventiv

The best way to maintain the quality of personal data is to implement routine automatic validation, which is a process of checking the accuracy, completeness, consistency, and timeliness of the data using automated tools or scripts. Routine automatic validation can help identify and correct any errors, anomalies, or discrepancies in the data, as well as ensure that the data meets the specified quality standards and requirements. Routine automatic validation can also help improve the efficiency and reliability of the data processing and analysis12.

References:

• CDPSE Exam Content Outline, Domain 3 – Data Lifecycle (Data Quality), Task 2: Implement data quality measures3.
• CDPSE Review Manual, Chapter 3 – Data Lifecycle, Section 3.2 – Data Quality4.

The best way to validate that privacy practices align to the published enterprise privacy management program is to conduct an audit. An audit is an independent and objective examination of evidence to provide assurance that privacy practices are effective and compliant with the enterprise privacy management program. An audit can also identify any gaps or weaknesses in the privacy practices and provide recommendations for improvement. An audit can be conducted internally or externally, depending on the scope, objectives, and standards of the audit. References: : CDPSE Review Manual (Digital Version), page 83

Attribute-based access control (ABAC) is the best approach for limiting the access of regional HR team members to employee data only within their regional office, because it allows for fine-grained and dynamic access control based on attributes of the subject, object, environment, and action. Attributes are characteristics or properties that can be used to describe or identify entities, such as users, resources, locations, roles, or permissions. ABAC uses policies and rules that evaluate the attributes and grant or deny access accordingly. For example, an ABAC policy could state that a user can access an employee record if and only if the user’s role is HR and the user’s region matches the employee’s region. This way, the access control can be tailored to the specific needs and context of the organization, without relying on predefined or fixed access levels.

References:

• Attribute-Based Access Control (ABAC), NIST
• What is Attribute-Based Access Control (ABAC)?, Axiomatics
• Access Control Models – Westoahu Cybersecurity, Westoahu Cybersecurity

The best way for an organization to maintain the effectiveness of its privacy breach incident response plan is to conduct annual data privacy tabletop exercises. A data privacy tabletop exercise is a simulated scenario that tests the organization’s ability to respond to a privacy breach incident, such as a data breach, leak, or misuse. A data privacy tabletop exercise involves key stakeholders, such as the privacy office, the information security team, the legal counsel, the public relations team, etc., who role-play their actions and decisions based on the scenario. A data privacy tabletop exercise helps to evaluate and improve the organization’s privacy breach incident response plan, such as identifying gaps or weaknesses, validating roles and responsibilities, verifying procedures and protocols, assessing communication and coordination, etc. References: : CDPSE Review Manual (Digital Version), page 83

The most useful information for prioritizing database selection for encryption is the asset classification scheme. An asset classification scheme is a system of organizing and categorizing assets based on their value, sensitivity, criticality, or risk level. An asset classification scheme helps to determine the appropriate level of protection or handling for each asset. For example, an asset classification scheme may assign labels such as public, internal, confidential, or secret to different types of data based on their impact if compromised. Databases that contain higher-classified data should be prioritized for encryption to prevent unauthorized access, disclosure, or modification.

Database administration audit logs, historical security incidents, or penetration test results are also useful information for database security, but they are not the most useful for prioritizing database selection for encryption. Database administration audit logs are records of activities performed by database administrators or other privileged users on the database system. Database administration audit logs help to monitor and verify the actions and changes made by authorized users and detect any anomalies or violations. Historical security incidents are records of events that have compromised or threatened the security of the database system in the past. Historical security incidents help to identify and analyze the root causes, impacts, and lessons learned from previous breaches or attacks. Penetration test results are reports of simulated attacks performed by ethical hackers or security experts on the database system to evaluate its vulnerabilities and defenses. Penetration test results help to discover and exploit any weaknesses or gaps in the database security posture and recommend remediation actions.

References: Data Classification Policy - SANS Institute, Database Security Best Practices - Oracle, [Database Security: An Essential Guide | IBM]

The most effective way to support organizational privacy awareness objectives is D. Customizing awareness training by business unit function.

A comprehensive explanation is:

Organizational privacy awareness objectives are the goals and expectations that an organization sets for its employees and stakeholders regarding the protection and management of personal data. Privacy awareness objectives may vary depending on the nature, scope, and purpose of the organization’s data processing activities, as well as the legal, regulatory, contractual, and ethical obligations and implications that apply to them.

One of the best practices to support organizational privacy awareness objectives is to customize awareness training by business unit function. This means that the organization should design and deliver privacy awareness training programs that are tailored to the specific roles, responsibilities, and needs of each business unit or department within the organization. Customizing awareness training by business unit function can have several benefits, such as:

• Enhancing the relevance and effectiveness of the training content and methods for each audience group, by addressing their specific privacy challenges, risks, and opportunities.
• Increasing the engagement and motivation of the trainees, by showing them how privacy relates to their daily tasks, goals, and performance.
• Improving the retention and application of the training knowledge and skills, by providing practical examples, scenarios, and exercises that reflect the real-world situations and problems that the trainees may encounter.
• Fostering a culture of privacy across the organization, by creating a common language and understanding of privacy concepts, principles, and practices among different business units or departments.

Some examples of how to customize awareness training by business unit function are:

• Providing different levels or modules of training based on the degree of access or exposure to personal data that each business unit or department has. For example, a basic level of training for all employees, an intermediate level of training for employees who handle personal data occasionally or incidentally, and an advanced level of training for employees who handle personal data regularly or extensively.
• Providing different topics or themes of training based on the type or category of personal data that each business unit or department processes. For example, a general topic of training for employees who process non-sensitive or non-personal data, a specific topic of training for employees who process sensitive or special data categories (such as health, biometric, financial, or political data), and a specialized topic of training for employees who process high-risk or high-value data (such as intellectual property, trade secrets, or customer loyalty data).
• Providing different formats or modes of training based on the preferences or constraints of each business unit or department. For example, a face-to-face format of training for employees who work in the same location or office, an online format of training for employees who work remotely or across different time zones, and a blended format of training for employees who work in a hybrid mode or have flexible schedules.

The other options are not as effective as option D.

Funding in-depth training and awareness education for data privacy staff (A) may improve the competence and confidence of the data privacy staff who are responsible for designing and implementing the privacy policies and practices of the organization, but it does not necessarily support the organizational privacy awareness objectives for the rest of the employees and stakeholders.

Implementing an annual training certification process (B) may ensure that the employees and stakeholders are updated and refreshed on the privacy policies and practices of the organization on a regular basis, but it does not necessarily address their specific privacy needs and challenges based on their business unit function.

Including mandatory awareness training as part of performance evaluations © may incentivize the employees and stakeholders to participate in and complete the privacy awareness training programs offered by the organization, but it does not necessarily enhance their understanding and application of privacy concepts and principles based on their business unit function.

References:

• The Benefits of Information Security and Privacy Awareness Training Programs1
• What Is Your Privacy and Data Protection Strategy?2
• What is Data Privacy Awareness?3

The primary means by which an organization communicates customer rights as it relates to the use of their personal information is publishing a privacy notice. A privacy notice is a document that informs the customers about how the organization collects, uses, shares, and protects their personal information, and what rights and choices they have regarding their data4. A privacy notice is a legal requirement under many data protection laws and regulations, such as the General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), or the Personal Information Protection and Electronic Documents Act (PIPEDA)5 . A privacy notice is also a good practice to demonstrate the organization’s commitment to transparency, accountability, and customer trust. References:

• ISACA Glossary of Terms
• Article 13 and 14 of the GDPR
• [Section 1798.100 of the CCPA]
• [Schedule 1, Principle 4.8 of the PIPEDA]
• [ISACA CDPSE Review Manual, Chapter 1, Section 1.3.2]

The best course of action to prevent false positives from data loss prevention (DLP) tools is to re-establish baselines for configuration rules. False positives are events that are triggered by a DLP policy in error, meaning that the policy has mistakenly identified non-sensitive data as sensitive or blocked legitimate actions. False positives can reduce the effectiveness and efficiency of DLP tools by generating unnecessary alerts, wasting resources, disrupting workflows, and creating user frustration. To avoid false positives, DLP tools need to have accurate and updated configuration rules that define what constitutes sensitive data and what actions are allowed or prohibited. Configuration rules should be based on clear and consistent criteria, such as data classification levels, data sources, data destinations, data formats, data patterns, user roles, user behaviors, etc. Configuration rules should also be regularly reviewed and adjusted to reflect changes in business needs, regulatory requirements, or threat landscape.

Conducting additional discovery scans, suppressing the alerts generating the false positives, or evaluating new DLP tools are not the best ways to prevent false positives from DLP tools. Conducting additional discovery scans may help identify more sensitive data in the network, but it does not address the root cause of false positives, which is the misconfiguration of DLP policies. Suppressing the alerts generating the false positives may reduce the noise and annoyance caused by false positives, but it does not solve the problem of inaccurate or outdated DLP policies. Evaluating new DLP tools may offer some advantages in terms of features or performance, but it does not guarantee that false positives will be eliminated or reduced without proper configuration and tuning of DLP policies.

References: False Positives Handling| Endpoint Data Loss Prevention - ManageEngine …, Scenario-based troubleshooting guide - DLP Issues, Respond to a DLP policy violation in Power BI - Power BI

After a privacy risk has been accepted, the next step is to monitor the risk landscape for material changes. This means that the organization should keep track of any internal or external factors that may affect the likelihood or impact of the risk, such as new threats, vulnerabilities, regulations, technologies, or business processes. Monitoring the risk landscape can help the organization identify if the risk acceptance decision is still valid, or if it needs to be revisited or revised. Monitoring can also help the organization prepare for potential incidents or consequences that may arise from the accepted risk.

System hardening is a process of applying security measures and configurations to a system to reduce its attack surface and enhance its resistance to threats. System hardening can include disabling unnecessary services, removing default accounts, applying patches and updates, enforcing strong passwords and encryption, and implementing firewalls and antivirus software. The primary benefit of system hardening is that it increases system resiliency, which is the ability of a system to withstand or recover from adverse events that could affect its functionality or performance. The other options are not the primary benefits of system hardening, although they may be secondary benefits or outcomes. System hardening does not necessarily reduce external threats to data, as threats can originate from various sources and vectors. System hardening may reduce exposure of data, but only if the data is stored or processed by the system. System hardening does not eliminate attack motivation for data, as attackers may have different motives and incentives for targeting data. , p. 91-92 References: : CDPSE Review Manual (Digital Version)

Encryption of network traffic is the most important control to mitigate the risk of potential personal data compromise when employees access corporate IT assets remotely. Encryption is a process that transforms data into an unreadable form, making it difficult for unauthorized parties to intercept, modify, or steal it. Encryption of network traffic ensures that the data transmitted between the remote employees and the corporate network is protected from eavesdropping, tampering, or leakage.

Intrusion prevention system (IPS), firewall rules review, and intrusion detection system (IDS) are also useful controls for network security, but they are not as effective as encryption for protecting personal data in transit. IPS and IDS can monitor and block malicious or suspicious network traffic, but they cannot prevent data exposure if the traffic is intercepted by a third party. Firewall rules review can help optimize and secure the firewall configuration, but it cannot guarantee that the firewall will not be bypassed or compromised by an attacker. Therefore, encryption of network traffic is the best option among the choices given.

The primary consideration to ensure control of remote access is aligned to the privacy policy is that access is only granted to authorized users. This means that the organization should implement and enforce policies and procedures to identify, authenticate, and authorize users who need to access personal data remotely, such as employees, contractors, or service providers. The organization should also define and communicate the roles and responsibilities of remote users, and the terms and conditions of remote access, such as the purpose, scope, duration, and security measures. By granting access only to authorized users, the organization can protect data privacy by preventing unauthorized or unnecessary access, use, disclosure, or transfer of personal data. References: : CDPSE Review Manual (Digital Version), page 107

An analysis of known threats is the best way for an organization to gain visibility into its exposure to privacy-related vulnerabilities because it helps identify the sources, methods and impacts of potential privacy breaches and assess the effectiveness of existing controls. A data loss prevention (DLP) solution, a review of historical privacy incidents and a monitoring of inbound and outbound communications are useful tools for detecting and preventing privacy violations, but they do not provide a comprehensive view of the organization’s privacy risk posture.

References:

• CDPSE Review Manual (Digital Version), Domain 1: Privacy Governance, Task 1.4: Coordinate and/or perform privacy impact assessments (PIA) and other privacy-focused assessments1
• CDPSE Certified Data Privacy Solutions Engineer All-in-One Exam Guide, Chapter 2: Privacy Governance, Section: Privacy Risk Assessment2

Transport Layer Security (TLS) is a protocol that provides secure communication over the internet by encrypting and authenticating data. TLS provides data integrity through the calculation of message digests, which are cryptographic hashes that summarize the content and structure of a message. The sender and the receiver of a message can compare the message digests to verify that the message has not been altered or corrupted during transmission. TLS also uses digital certificates, asymmetric encryption, and symmetric encryption to provide confidentiality and authentication, but these are not directly related to data integrity.

References: CDPSE Review Manual, 2021, p. 117

The most important consideration when writing an organization’s privacy policy is to align the statements to the organizational practices, because this will help ensure that the policy is accurate, consistent, and transparent. A privacy policy is a document that explains how the organization collects, uses, discloses, and protects personal data from its customers, employees, partners, and other stakeholders. A privacy policy should reflect the actual data processing activities and privacy measures of the organization, as well as comply with the applicable laws and regulations. A privacy policy that is not aligned with the organizational practices may lead to confusion, mistrust, or legal liability12.

References:

• CDPSE Review Manual, Chapter 1 – Privacy Governance, Section 1.2 – Privacy Policy3.
• CDPSE Certified Data Privacy Solutions Engineer All-in-One Exam Guide, Chapter 1 – Privacy Governance, Section 1.2 – Data Privacy Laws and Regulations4.

Input validation controls are the best way to ensure consumer credit card numbers are accurately captured. Input validation controls are methods that check the format, type, range, and length of the input data before accepting, processing, or storing it. Input validation controls can help prevent errors, fraud, or data loss by rejecting invalid, incomplete, or malicious input. For example, input validation controls can verify that a credit card number follows the Luhn algorithm1, has the correct number of digits2, and matches the card issuer’s prefix3. Input validation controls can also prevent SQL injection attacks4 or cross-site scripting attacks5 that may compromise the security and privacy of the data.

Input reference controls, access controls, and reconciliation controls are also important for data quality and security, but they do not directly ensure the accuracy of consumer credit card numbers. Input reference controls are methods that compare the input data with a predefined list of values or a reference table to ensure consistency and validity. For example, input reference controls can check if a country name or a postal code is valid by looking up a database of valid values. Access controls are methods that restrict who can access, modify, or delete the data based on their roles, permissions, or credentials. For example, access controls can prevent unauthorized users from accessing or tampering with consumer credit card numbers. Reconciliation controls are methods that compare the data from different sources or systems to ensure completeness and accuracy. For example, reconciliation controls can check if the transactions recorded in the accounting system match the transactions processed by the payment gateway.

References: Luhn algorithm, Credit card number, Bank card number, SQL injection, Cross-site scripting

A privacy risk assessment is a process of identifying, analyzing and evaluating the privacy risks associated with the collection, use, disclosure or retention of personal data. A privacy risk assessment is the best way to distinguish between a privacy risk and compliance risk, as it would help to determine the likelihood and impact of privacy incidents or breaches that could affect the rights and interests of the data subjects, as well as the legal obligations and responsibilities of the organization. A privacy risk assessment would also help to identify and implement appropriate controls and measures to mitigate or reduce the privacy risks and ensure compliance with privacy principles, laws and regulations. The other options are not as effective as conducting a privacy risk assessment in distinguishing between a privacy risk and compliance risk. Performing a privacy risk audit is a process of verifying and validating the effectiveness and adequacy of the privacy controls and measures implemented by the organization, but it does not necessarily identify or evaluate the privacy risks or compliance risks. Validating a privacy risk attestation is a process of confirming and certifying the accuracy and completeness of the privacy information or statements provided by the organization, but it does not necessarily identify or evaluate the privacy risks or compliance risks. Conducting a privacy risk remediation exercise is a process of implementing corrective actions or improvements to address the identified or reported privacy risks or compliance risks, but it does not necessarily distinguish between them1, p. 66-67 References: 1: CDPSE Review Manual (Digital Version)

Application hardening measures are the most important action to protect a mobile banking app and its data against manipulation and disclosure because they prevent attackers from reverse engineering, tampering, or injecting malicious code into the app. Application hardening measures include techniques such as code obfuscation, encryption, integrity checks, anti-debugging, and anti-tampering mechanisms. These measures make the app more resilient and secure against various types of cyberattacks.

References:

• ISACA Certified Data Privacy Solutions Engineer Study Guide, Domain 3: Privacy Engineering, Task 3.4: Implement privacy engineering techniques to protect data in applications and systems, p. 104-105.
• What is Application Hardening? | Glossary | Digital.ai

Requiring independent audits of the providers’ data privacy controls is the best way to ensure third-party providers that process an organization’s personal data are addressed as part of the data privacy strategy. Independent audits can verify that the providers are complying with the applicable data privacy laws and regulations, as well as the organization’s own policies and standards. Independent audits can also identify any gaps or weaknesses in the providers’ data privacy controls and recommend corrective actions or improvements.

References:

• What Is Your Privacy and Data Protection Strategy? - ISACA
• Why data privacy and third-party risk teams need to work together - OneTrust

Degaussing is a hard drive sanitation method that uses a powerful magnetic field to erase or destroy the data stored on a magnetic disk or tape. Degaussing should be used to sanitize hard drives containing personal data prior to being crushed, as it provides an additional layer of assurance that data has been permanently erased and cannot be recovered by any means. Degaussing also damages the drive itself, making it unusable for future storage. The other options are not effective or necessary hard drive sanitation methods prior to being crushed. Low-level formatting is a hard drive sanitation method that erases the data and the partition table on the drive, but it may leave some traces of data that can be recovered by forensic tools or software. Remote partitioning is a hard drive sanitation method that creates separate logical sections on the drive, but it does not erase or destroy the data on the drive. Hammer strike is a hard drive sanitation method that physically damages the drive by hitting it with a hammer, but it may not erase or destroy the data completely or prevent data recovery by advanced tools or techniques1, p. 93-94 References: 1: CDPSE Review Manual (Digital Version)

Encryption is a security practice that transforms data into an unreadable format using a secret key or algorithm. Encryption protects the confidentiality and integrity of data, especially when they are transferred using email or other communication channels. Encryption ensures that only authorized parties can access and use the data, while unauthorized parties cannot decipher or modify the data without the key or algorithm. Encryption also helps to comply with data protection laws and regulations, such as the General Data Protection Regulation (GDPR) or the California Consumer Privacy Act (CCPA), which require data controllers and processors to implement appropriate technical and organizational measures to safeguard personal data.

Centrally managed encryption is a type of encryption that is implemented and controlled by a central authority or system, such as an organization or a service provider. Centrally managed encryption has the following advantages over end user-managed encryption, private cloud storage space, or password-protected .zip files, for reducing the risk of compromise when transferring personal information using email:

• It can enforce consistent and standardized encryption policies and procedures across the organization or the service, such as the encryption standards, algorithms, keys, modes, and formats.
• It can automate the encryption and decryption processes for the users, without requiring them to perform any manual actions or install any software or plug-ins on their devices.
• It can monitor and audit the encryption activities and incidents, and provide visibility and accountability for the data protection and compliance status.
• It can reduce the human errors or negligence that may compromise the encryption security, such as losing or sharing the keys, forgetting or reusing the passwords, or sending the data to the wrong recipients.

References:

• Encryption in the Hands of End Users - ISACA, section 2: “A key goal of encryption is to protect the file even when direct access is possible or the transfer is intercepted.”
• The Complexity Conundrum: Simplifying Data Security - ISACA, section 3: “Centrally managed encryption solutions can help enterprises overcome these challenges by providing a unified platform for encrypting data across different environments and applications.”
• Email Encryption: What You Need to Know - Lifewire, section 1: “Email encryption is a way of protecting your email messages from being read by anyone other than the intended recipients.”

Online behavioral tracking is a tracking technology associated with unsolicited targeted advertisements that presents the greatest privacy risk. Online behavioral tracking is a technique that collects and analyzes personal data about users’ online activities, preferences, interests, and behaviors across different websites or platforms. Online behavioral tracking is used to create user profiles and deliver personalized or targeted advertisements that match users’ needs or wants. Online behavioral tracking poses a privacy risk because it can invade users’ privacy by collecting sensitive or intimate personal data without their knowledge or consent, such as health conditions, political views, sexual orientation, etc. Online behavioral tracking can also expose users to unwanted or inappropriate advertisements that may influence their decisions or actions. References: : CDPSE Review Manual (Digital Version), page 139

One of the key principles of data protection is transparency, which means that individuals have the right to be informed about the collection and use of their personal data. This applies to video surveillance as well, especially in high security areas where the impact on privacy may be significant. Therefore, it is important to inform those affected by video surveillance about the purpose, scope, retention and access policies of the data collected.

References:

• ISACA Certified Data Privacy Solutions Engineer (CDPSE) Exam Content Outline, Domain 2: Privacy Architecture, Task 2.1: Design privacy controls based on privacy principles and legal requirements, Subtask 2.1.1: Identify applicable privacy principles and legal requirements.
• How can we comply with the data protection principles when using surveillance systems? | ICO

Data mapping is the process of defining how data elements from different sources are related, transformed, and transferred to a common destination. Data mapping is the first step when developing an application link because it helps to ensure that the data exchanged between the API and the third-party application is consistent, accurate, and compatible. Data mapping also helps to identify any gaps, errors, or conflicts in the data and resolve them before the data transfer occurs.

References:

• What is Data Mapping?, Talend
• Data Mapping: What It Is and How to Do It, Xplenty

A mobile application implementation should meet the organization’s data security standards by ensuring that the application does not contain any vulnerabilities, errors or malicious code that could compromise the confidentiality, integrity or availability of the data. An automatic dynamic code scan is a technique that analyzes the application code while it is running to detect and report any security issues or defects. An automatic dynamic code scan can help to identify and fix any potential data security risks before the application is deployed. The other options are not sufficient to ensure data security standards. UAT is a process of verifying that the application meets the user requirements and expectations, but it does not necessarily test for data security. Data classification is a process of categorizing data according to its sensitivity and value, but it does not ensure that the data is protected by the application. A PIA is a process of identifying and evaluating the privacy impacts of a system or project that involves personal data, but it does not ensure that the system or project meets data security standards. , p. 89-90 References: : CDPSE Review Manual (Digital Version)

Data retention is a process of keeping personal data for a specified period of time for legitimate purposes, such as legal obligations, contractual agreements, business operations or historical records. Data retention should be based on the principle of data minimization, which requires limiting the collection, storage and processing of personal data to what is necessary and relevant for the intended purposes. Data retention should also comply with the principle of storage limitation, which requires deleting or disposing of personal data when it is no longer needed or justified. The most likely valid use case for keeping a customer’s personal data after contract termination is a required retention period due to regulations, such as tax laws, financial laws, health laws or consumer protection laws, that mandate the organization to retain certain types of customer data for a certain period of time after the end of the contractual relationship. The other options are not valid use cases for keeping a customer’s personal data after contract termination, as they do not meet the criteria of necessity, relevance or justification. For the purpose of medical research, the organization would need to obtain the consent of the customer or have another legal basis for processing their personal data for a different purpose than the original contract. A forthcoming campaign to win back customers or ease of onboarding when the customer returns are not legitimate purposes for retaining customer data after contract termination, as they are not related to the original contract and may violate the customer’s privacy rights and preferences. , p. 99-100 References: : CDPSE Review Manual (Digital Version)

Software hardening is a technique that mitigates design flaws in the application development process that may contribute to potential leakage of personal data. Software hardening is a process of modifying or configuring software to make it more secure and resilient against attacks or exploitation. Software hardening can involve various methods, such as removing unnecessary features or functions, disabling debugging or testing modes, applying patches or updates, implementing secure coding practices, etc. Software hardening helps to protect personal data by preventing or reducing the vulnerabilities that can allow unauthorized access, use, disclosure, or transfer of personal data. References: : CDPSE Review Manual (Digital Version), page 151

The right to be forgotten is a privacy right that allows individuals to request the deletion or removal of their personal data from a data controller’s records or systems under certain conditions. One of these conditions is when the data is no longer required for the purpose originally collected, meaning that the data has become obsolete, irrelevant or excessive for fulfilling the initial purpose for which it was obtained or processed by the data controller. The other options are not valid conditions for exercising the right to be forgotten. The data is being used to comply with legal obligations or public interest is an exception that may prevent the data controller from deleting or removing the data upon request, as there may be overriding legitimate grounds for retaining the data for legal compliance or public interest reasons. The individual objects despite legitimate grounds for processing is a condition for exercising the right to object, not the right to be forgotten, which allows individuals to oppose the processing of their personal data based on their particular situation or for direct marketing purposes. The individual’s legal residence status has recently changed is not a relevant factor for exercising the right to be forgotten, as it does not affect the necessity or relevance of the data for its original purpose1, p. 107-108 References: 1: CDPSE Review Manual (Digital Version)

Validation and certification of data destruction is the most important consideration when choosing a method for data destruction, because it provides evidence that the data has been destroyed beyond recovery and that the organization has complied with the applicable information security frameworks and legal requirements. Validation and certification can also help to prevent data breaches, avoid legal liabilities, and enhance the organization’s reputation and trustworthiness. Different methods of data destruction may have different levels of validation and certification, depending on the type of media, the sensitivity of the data, and the standards and guidelines followed. For example, some methods may require a third-party verification or audit, while others may generate a certificate of destruction or a report of erasure. Therefore, the organization should choose a method that can provide sufficient validation and certification for its specific needs and obligations.

References:

• Secure Data Disposal and Destruction: 6 Methods to Follow, KirkpatrickPrice
• Data Destruction Standards and Guidelines, BitRaser
• Best Practices for Data Destruction, U.S. Department of Education

The best testing method to identify and review the application’s runtime modules is dynamic application security testing (DAST). DAST is a testing technique that analyzes the application’s behavior and functionality during its execution. DAST can detect security and privacy vulnerabilities that are not visible in the source code, such as injection attacks, cross-site scripting, broken authentication, sensitive data exposure, or improper error handling. DAST can also simulate real-world attacks and test the application’s response and resilience. DAST can provide a comprehensive and realistic assessment of the application’s security and privacy posture in the pre-production environment. References:

• [ISACA Glossary of Terms]
• [OWASP Top 10 Web Application Security Risks]
• [ISACA CDPSE Review Manual, Chapter 2, Section 2.4.2]
• [ISACA Journal, Volume 6, 2018, “Dynamic Application Security Testing”]

The best control to prevent data leakage for a cloud-based HR solution with a mobile application interface is to disable the download of data to the mobile devices. This is because downloading data to the mobile devices increases the risk of data loss, theft, or unauthorized access, especially if the devices are lost, stolen, or compromised. Disabling the download of data to the mobile devices ensures that the data remains in the cloud-based solution, where it can be protected by encryption, access control, and other security measures. The other options are not as effective or sufficient as disabling the download of data to the mobile devices, as they do not address the root cause of the data leakage risk, which is the exposure of data outside the cloud-based solution.

References: CDPSE Review Manual, 2021, p. 128

The first step when performing a data quality assessment is to assess the completeness of the data inventory, which is a comprehensive list of all data assets within the organization. This will help identify the scope, sources, owners, and characteristics of the data to be assessed. The other options are possible actions that may be taken after the data inventory is complete, depending on the objectives and criteria of the assessment.

References:

• CDPSE Exam Content Outline, Domain 3 – Data Lifecycle (Data Quality), Task 1: Perform a data quality assessment1.
• CDPSE Review Manual, Chapter 3 – Data Lifecycle, Section 3.2 – Data Quality2.

Data anonymization is a method of protecting personal data by modifying or removing any information that can be used to identify an individual, either directly or indirectly, in a data set. Data anonymization aims to prevent the re-identification of the data subjects, even by the data controller or processor, or by using additional data sources or techniques. Data anonymization also helps to comply with data protection laws and regulations, such as the General Data Protection Regulation (GDPR) or the California Consumer Privacy Act (CCPA), which require data controllers and processors to respect the privacy rights and preferences of the data subjects.

The data is transformed such that re-identification is impossible is an example of data anonymization, as it involves applying irreversible techniques, such as aggregation, generalization, perturbation, or synthesis, to alter the original data in a way that preserves their utility and meaning, but eliminates their identifiability. For example, a database of customer transactions can be anonymized by replacing the names and addresses of the customers with random codes, and by adding noise or rounding to the amounts and dates of the transactions.

The other options are not examples of data anonymization, but of other methods of protecting personal data that do not guarantee the impossibility of re-identification. The data is encrypted and a key is required to re-identify the data is an example of data pseudonymization, which is a method of replacing direct identifiers with pseudonyms, such as codes or tokens, that can be linked back to the original data with a key or algorithm. Data pseudonymization does not prevent re-identification by authorized parties who have access to the key or algorithm, or by unauthorized parties who can break or bypass the encryption. Key fields are hidden and unmasking is required to access to the data is an example of data masking, which is a method of concealing or obscuring sensitive data elements, such as names or credit card numbers, with characters, symbols or blanks. Data masking does not prevent re-identification by authorized parties who have permission to unmask the data, or by unauthorized parties who can infer or guess the hidden data from other sources or clues. Names and addresses are removed but the rest of the data is left untouched is an example of data deletion, which is a method of removing direct identifiers from a data set. Data deletion does not prevent re-identification by using indirect identifiers, such as age, gender, occupation or location, that can be combined or matched with other data sources to re-establish the identity of the data subjects.

References:

• Big Data Deidentification, Reidentification and Anonymization - ISACA, section 2: “Anonymization is the ability for the data controller to anonymize the data in a way that it is impossible for anyone to establish the identity of the data.”
• Data Anonymization - Overview, Techniques, Advantages, section 1: “Data anonymization is a method of ensuring that the company understands and enforces its duty to secure sensitive, personal, and confidential data in a world of highly complex data protection mandates that can vary depending on where the business and the customers are based.”

Data sanitization is a process of permanently erasing or destroying data from a storage device or media to prevent unauthorized access or recovery of the data. Data sanitization methods can include physical destruction, degaussing, overwriting, encryption or cryptographic erasure. The most important consideration when using advanced data sanitization methods to ensure privacy data will be unrecoverable is the type of media on which the data is stored, as different media types may require different methods or techniques to achieve effective sanitization. For example, physical destruction may be suitable for optical disks or tapes, but not for solid state drives (SSDs) or flash memory devices. Degaussing may be effective for magnetic disks or tapes, but not for optical disks or SSDs. Overwriting may work for hard disk drives (HDDs) or SSDs, but not for tapes or optical disks. Encryption or cryptographic erasure may be applicable for any media type, but may require additional security measures to protect the encryption keys or certificates. The other options are not as important as the type of media when using advanced data sanitization methods. Subject matter expertise may be helpful, but not essential, as long as the appropriate method is selected and applied correctly. Regulatory compliance requirements may influence the choice of method, but not necessarily determine it, as different methods may meet different standards or criteria. Location of data may affect the feasibility or cost of applying a method, but not its effectiveness or suitability., p. 93-94 References: : CDPSE Review Manual (Digital Version)

Data masking is the process of hiding original data with modified content to protect sensitive data from unauthorized access or disclosure. Data masking is often used for testing purposes in non-production environments, where personal data is not needed or allowed. However, data masking can pose several challenges, especially for a global financial institution that has multiple interconnected systems and applications. One of the greatest challenges is to preserve the complex relationships within and across systems while masking the data. This means that the masked data must maintain the same format, referential integrity, semantic integrity, and uniqueness as the original data, so that the testing results are valid and reliable. For example, if a customer’s name is masked in one system, it must be masked consistently in all other systems that reference it. If a transaction amount is masked in one system, it must not violate any business rules or constraints in another system. If a credit card number is masked in one system, it must still be a valid credit card number in another system. Preserving these complex relationships can be challenging because it requires a thorough understanding of the data model, the business logic, and the dependencies among systems. It also requires a robust and flexible data masking tool that can handle different types of data and platforms.

The most important information to capture in the audit log of an application hosting personal data is the last user who accessed personal data. This is because the audit log is a record of the activities and events that occur within the application, such as user actions, system events, errors, or exceptions. The audit log helps to monitor and verify the compliance, security, and performance of the application, as well as to detect and investigate any incidents or anomalies. Capturing the last user who accessed personal data in the audit log helps to ensure the accountability and traceability of the data access, as well as to identify and prevent any unauthorized or inappropriate use, disclosure, or modification of personal data.

References: CDPSE Review Manual, 2021, p. 147

One of the most common vulnerabilities that can compromise the access to personal information is end users using weak passwords. Weak passwords are passwords that are easy to guess, crack, or steal, such as passwords that are short, simple, common, or reused. Weak passwords can allow unauthorized or malicious parties to gain access to personal information and cause privacy breaches, leaks, or misuse. Multi-factor authentication is an effective way to mitigate this vulnerability, as it requires end users to provide more than one piece of evidence to verify their identity, such as something they know (e.g., password), something they have (e.g., token), or something they are (e.g., biometric). Multi-factor authentication makes it harder for attackers to bypass the authentication process and access personal information. References: : CDPSE Review Manual (Digital Version), page 107

A data inventory is a comprehensive list of the data that an organization collects, processes, stores, transfers, and disposes of. It includes information such as the type, source, location, owner, purpose, and retention period of the data. A data inventory is essential for understanding where personal data is coming from and how it is used within the organization, as well as for complying with data privacy laws and regulations. A data inventory also helps to identify and mitigate data privacy risks and gaps.

References:

• ISACA, CDPSE Review Manual 2021, Chapter 2: Privacy Governance, Section 2.2: Data Inventory and Data Mapping, p. 40-41.
• ISACA, Data Privacy Audit/Assurance Program, Control Objective 3: Data Inventory and Classification, p. 7-81

Restricting access to authorized users is the best control to secure application programming interfaces (APIs) that may contain personal information, as it would prevent unauthorized access, modification or disclosure of the personal information by third parties or intermediaries. Restricting access to authorized users can be achieved by using various methods, such as authentication, authorization, encryption, tokens or certificates. The other options are not effective controls to secure APIs that may contain personal information. Encrypting APIs with the organization’s private key is not a feasible or desirable method, as it would make the APIs unreadable by anyone who does not have the corresponding public key, which would defeat the purpose of using APIs for interoperability and integration. Requiring nondisclosure agreements (NDAs) when sharing APIs is not a reliable or enforceable method, as it would depend on the compliance and cooperation of the parties who receive the APIs, and it would not prevent unauthorized access, modification or disclosure of the personal information by third parties or intermediaries who are not bound by the NDAs. Sharing only digitally signed APIs is not a sufficient method, as it would only ensure the authenticity and integrity of the APIs, but it would not prevent unauthorized access, modification or disclosure of the personal information by third parties or intermediaries who can read or intercept the APIs1, p. 90-91 References: 1: CDPSE Review Manual (Digital Version)

Reviewing proposed privacy rules that govern the processing of personal data is the most useful action to help define the scope of the project because it helps identify the legal and regulatory requirements, the data protection principles and the privacy objectives that the information security controls need to support. Reviewing recent audit reports, identifying databases that contain personal data or do not have encryption in place are helpful actions to assess the current state of privacy and security, but they do not provide a clear direction for the project scope.

References:

• CDPSE Review Manual (Digital Version), Domain 2: Privacy Architecture, Task 2.1: Identify and/or define privacy requirements1
• CDPSE Certified Data Privacy Solutions Engineer All-in-One Exam Guide, Chapter 3: Privacy Architecture, Section: Privacy Requirements2

The best answer is D. Assess the organization’s exposure related to the migration.

A comprehensive explanation is:

Before an organization migrates data from an on-premise solution to a cloud-hosted solution that spans more than one jurisdiction, it should first assess its exposure related to the migration. This means that the organization should identify and evaluate the potential risks and benefits of moving its data to the cloud, taking into account the legal, regulatory, contractual, and ethical obligations and implications of doing so.

Some of the factors that the organization should consider in its assessment are:

• The nature, sensitivity, and value of the data being migrated, and the impact of its loss, theft, corruption, or disclosure on the organization and its stakeholders.
• The security, privacy, and compliance requirements and standards that apply to the data in each jurisdiction where it is stored, processed, or accessed, and the differences or conflicts among them.
• The trustworthiness, reliability, and reputation of the cloud service provider and its subcontractors, and the terms and conditions of their service level agreements (SLAs) and contracts.
• The availability, performance, scalability, and cost-effectiveness of the cloud-hosted solution compared to the on-premise solution, and the trade-offs involved.
• The technical feasibility and complexity of migrating the data from the on-premise solution to the cloud-hosted solution, and the tools and methods needed to do so.
• The organizational readiness and capability to manage the change and transition from the on-premise solution to the cloud-hosted solution, and the training and support needed for the staff and users.

By conducting a thorough assessment of its exposure related to the migration, the organization can make an informed decision about whether to proceed with the migration or not, or under what conditions or modifications. The assessment can also help the organization to plan and implement appropriate measures and controls to mitigate or avoid any negative consequences and enhance or maximize any positive outcomes of the migration.

Ensuring data loss prevention (DLP) alerts are turned on (A), encrypting the data while it is being migrated (B), and conducting a penetration test of the hosted solution © are all good practices to protect data privacy and security when migrating data from an on-premise solution to a cloud-hosted solution that spans more than one jurisdiction. However they are not the first steps that should be done before the migration. They are more relevant during or after the migration process. They also do not address other aspects of exposure related to the migration, such as legal, regulatory, contractual, or ethical issues.

References:

• Data Migration: On-Premise to Cloud - 10 Steps to Success1
• 8 Best Practices for On-Premises to Cloud Migration2
• 5 Steps for a Successful On-Premise to Cloud Migration3
• Extend on-premises data solutions to the cloud4
• On Premise to Cloud migration tool5

User behavior analytics is a technology that uses data analysis and machine learning to monitor, detect and respond to anomalous or malicious user activities, such as accessing sensitive personal customer information to use for unauthorized purposes. User behavior analytics is the best choice to mitigate this risk, as it would help to identify and prevent insider threats, data breaches, fraud or misuse of data by authorized individuals. User behavior analytics can also help to enforce policies and controls, such as access control, audit trail or data loss prevention. The other options are not as effective as user behavior analytics in mitigating this risk. Email filtering system is a technology that scans and blocks incoming or outgoing emails that contain spam, malware or phishing attempts, but it does not address the issue of authorized individuals accessing sensitive personal customer information to use for unauthorized purposes. Intrusion monitoring is a technology that monitors and alerts on unauthorized or malicious attempts to access a system or network, but it does not address the issue of authorized individuals accessing sensitive personal customer information to use for unauthorized purposes. Mobile device management (MDM) is a technology that manages and secures mobile devices that are used to access or store organizational data, but it does not address the issue of authorized individuals accessing sensitive personal customer information to use for unauthorized purposes1, p. 92 References: 1: CDPSE Review Manual (Digital Version)

The greatest benefit of adopting data minimization practices is that the associated threat surface is reduced. Data minimization is a privacy principle that states that personal data should be adequate, relevant, and limited to what is necessary for the purposes for which they are processed. Data minimization helps to protect data privacy by reducing the amount and type of personal data that are collected, stored, processed, or shared by an organization. This in turn reduces the exposure of personal data to potential threats, such as unauthorized access, use, disclosure, modification, or loss. References: : CDPSE Review Manual (Digital Version), page 29

The role primarily assigned to an internal data owner is authorizing access rights. A data owner is a person or a role within the organization who has the authority and responsibility for the data assets under their control. A data owner is responsible for defining the data classification, data quality, data retention, and data security requirements for their data assets. A data owner is also responsible for granting, revoking, and reviewing the access rights to their data assets based on the principle of least privilege and the business needs. A data owner is accountable for ensuring that the data assets are used in compliance with the organizational policies and the applicable laws and regulations. References:

• [ISACA Glossary of Terms]
• [ISACA CDPSE Review Manual, Chapter 3, Section 3.2.1]
• [ISACA CDPSE Review Manual, Chapter 3, Section 3.2.2]
• [ISACA CDPSE Review Manual, Chapter 3, Section 3.2.3]

Sensitive personal data is a subset of personal data that reveals or relates to more intimate or confidential aspects of a person’s identity, such as their racial or ethnic origin, religious or philosophical beliefs, health status, sexual orientation, political opinions, trade union membership, biometric or genetic data, or criminal record. Sensitive personal data is subject to more stringent legal and regulatory protections and requires a higher level of consent from the data subject to be processed. Mailing address, bank account login ID, and contact phone number are examples of personal data, but not sensitive personal data, as they do not reveal or relate to such intimate or confidential aspects of a person’s identity.

References: CDPSE Review Manual, 2021, p. 29

Remote employee monitoring software is a solution that collects, analyzes and reports data on the activities and behaviors of employees who work remotely or from home. It can help organizations to measure and improve employee productivity, performance, engagement and security. However, it also poses significant privacy risks and challenges, as it may involve the collection and processing of personal data, such as names, email addresses, biometric data, IP addresses, keystrokes, screenshots, web browsing history, app usage, communication content and frequency, etc.

Data access should be restricted based on roles, meaning that only authorized and legitimate parties should be able to access and use the data collected by the remote employee monitoring software, based on their roles and responsibilities within the organization. This is a key privacy principle and practice that helps to protect the privacy rights and interests of the employees, and to prevent unauthorized or excessive access, use, disclosure or modification of their personal data by the organization or third parties. Data access restriction based on roles also helps to comply with data protection laws and regulations, such as the General Data Protection Regulation (GDPR) or the California Consumer Privacy Act (CCPA), which require data controllers and processors to implement appropriate technical and organizational measures to safeguard personal data.

References:

• Mobile Workforce Security Considerations and Privacy - ISACA, section 3: “The principle of least privilege should be applied to ensure that only authorized personnel have access to the data.”
• Why Employee Privacy Matters More Than Ever - ISACA, section 3: “Privacy-first monitoring should include granular privacy controls, including: Auto-redacting personal information; Restricting access to sensitive information based on role; Masking sensitive information from view.”

Any organization collecting information about EU residents is required to operate with transparency in collecting and using their personal information. Chapter III of the GDPR defines eight data subject rights that have become foundational for other privacy regulations around the world:

Right to access personal data. Data subjects can access the data collected on them.

One of the privacy requirements related to the rights of data subjects is the right to access, which means that individuals have the right to obtain a copy of their personal data, as well as information about how their data is processed, by whom, for what purposes, and for how long. To meet this requirement, an organization’s technology stack should incorporate features that allow individuals to have direct access to their data, such as self-service portals, dashboards, or applications. This way, individuals can exercise their right to access without relying on intermediaries or manual processes, which can be inefficient, error-prone, or insecure. References: : CDPSE Review Manual (Digital Version), page 137