Which of the following is NOT relevant to a user exercising their data portability rights?
Answer(s): B
Why option B is not relevant to a user exercising data-portability rightsData-portability under the GDPR (Art. 20) allows a data subject to obtain a copy of their personal data in a structured, commonly used and machine-readable format, and to transmit that data to another controller. The right is technical and procedural , not a security-or threat-detection function. Option B – “Detection of phishing attacks against the portability interface.” describes a security-monitoring activity that a controller might perform to protect the interface used for data export. This activity does not help the data subject receive or transfer their own data; it is a defensive measure unrelated to the substantive rights granted by Art. 20.Why the other options are relevantA – “Notice and consent for the downloading of data.”Controllers must inform the data subject about the availability of the portability feature and obtain a clear, informed consent before initiating the download. This procedural step is directly required to exercise the right.C – “Re-authentication of an account, including two-factor authentication as appropriate.”To ensure that the data is transferred to the rightful owner, controllers must verify the identity of the requester (e.g., by re-authenticating with MFA). This safeguard is essential for the lawful handling of a portability request.D – “Validation of users with unauthenticated identifiers (e.g., IP address, physical address).”Controllers must distinguish legitimate portability requests from fraudulent ones. Using identifiers such as the requester’s IP address or other authentication evidence, combined with appropriate validation, helps confirm the user’s identity and prevents abuse of the right.Summary Only option B describes a security function that protects the portability interface rather than facilitating the data subject’s ability to obtain, copy, or transmit their personal data. The other options are integral steps— notice/consent, identity verification, and fraud-prevention—that directly support the effective exercise of data-portability rights.
European Union – General Data Protection Regulation (GDPR), Article 20 – Right to data portability. https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32016R0679 UK Information Commissioner’s Office (ICO) – Guidance on data portability. https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation/gdata-protection.htm#data-portability
In order to prevent others from identifying an individual within a data set, privacy engineers use a cryptographically-secure hashing algorithm. Use of hashes in this way illustrates the privacy tactic known as what?
Answer(s): B – ObfuscationTechnical justification:Cryptographic hashing produces a deterministic, irreversible output that makes it computationally infeasible to retrieve the original input from the hash value. By applying a secure hash to personal identifiers (e.g., turning a name into a fixed-length hash), the data becomes obscured from direct re-identification, which is the core purpose of the obfuscation privacy tactic. Obfuscation deliberately masks or transforms data so that it is no longer immediately recognizable as a specific individual, while still preserving analytical utility when needed.Why the other options do not fit as well:Isolation (A) – Refers to separating data into distinct silos or environments (e.g., network segmentation) to limit exposure; it does not inherently transform the data’s content. Perturbation (C) – Involves deliberately adding noise or statistical distortion (e.g., adding random values) to achieve differential privacy or data masking; the transformation is not cryptographically irreversible and is intended to protect statistical properties rather than guarantee one-way concealment. Stripping (D) – Entails removing personally identifiable fields entirely (e.g., deleting a name column). While it removes identifiers, it does not mask them through a transformation; instead, it simply eliminates the data element.Thus, the use of a cryptographically-secure hash to prevent direct identification exemplifies the privacy tactic obfuscation .
International Association of Privacy Professionals (IAPP) – Certified Information Privacy Technologist (CIPT) program overview and body-of-knowledge guidance. https://iapp.org/certify/cpt/NIST Special Publication 800-88 Revision 1 – “Guide to Testing and Acceptance of Cryptographic Modules”. (Relevant for understanding cryptographic hashing as a de-identification technique.) https://csrc.nist.gov/publications/detail/sp/800-88/rev-1/final
An organization based in California, USA is implementing a new online helpdesk solution for recording customer call information. The organization considers the capture of personal data on the online helpdesk solution to be in the interest of the company in best servicing customer calls. Before implementation, a privacy technologist should conduct which of the following?
Correct answer: B – Conduct a privacy risk and impact assessment to evaluate potential risks from the proposed processing operations.Why B is best: A privacy risk and impact assessment aligns directly with the core responsibilities of a privacy technologist under modern data-protection frameworks (e.g., GDPR Art. 35). It systematically identifies, evaluates, and mitigates privacy risks associated with the collection, storage, and use of personal data by the new help-desk solution. This assessment informs whether the processing is necessary, proportionate, and compliant with the organization’s privacy policies and legal obligations before any technical implementation proceeds.Why the other options are less suitable: A. A Data Protection Impact Assessment (DPIA) is indeed part of the process, but it must be coupled with a broader privacy risk assessment ; merely consulting a regulator does not replace the need to analyze the technical and operational risks themselves. C. A Legitimate Interest Assessment (LIA) addresses only the lawful-basis justification and proportionality test; it does not comprehensively evaluate downstream privacy risks, security controls, or data-subject rights that a privacy technologist must manage. D. A security assessment of the technology and provider is essential from an information-security perspective, but it focuses on technical safeguards rather than the privacy-centric evaluation of data-subject impact that a CIPT professional is mandated to perform.In summary, the privacy technologist should lead a privacy risk and impact assessment to ensure the proposed processing is privacy-by-design, risk-aware, and compliant with applicable regulations.
International Association of Privacy Professionals (IAPP). What is a Data-Protection Impact Assessment (DPIA)? https://iapp.org/resources/article/what-is-a-data-protection-impact-assessment-dpias/ GDPR-EU. Article 35 – Data protection impact assessment (DPIA). https://gdpr.eu/article-35-data-protection-impact-assessment/
Which technique is most likely to facilitate the deletion of every instance of data associated with a deleted user account from every data store held by an organization?
Why option B is the most appropriate techniqueA standardized and documented retention program defines the lifecycle of user-related data, specifies retention periods, and mandates a clear predicate (e.g., account deletion) for disposal. The program incorporates a formal deletion process that triggers across every repository—primary databases, analytics warehouses, backup archives, and log storage—ensuring that every copy is identified and purged. By classifying data by owner and linking it to user identifiers, the program can automatically locate all assets tied to a particular user, regardless of where they reside, and automate the wipe request. Documentation and policy provide audit trails and compliance evidence , making the deletion repeatable, verifiable, and scalable—criteria that auditors and regulators expect for the “right to erasure.”Why the other options are less suitableA: Auditing the code which deletes user accounts – This is a reactive, after-the-fact check; it does not guarantee that data stored in non-application systems (e.g., backups, third-party caches) is removed, nor does it establish a repeatable workflow for every data store. C. Monitoring each data store for the presence of data associated with the deleted user – Monitoring is also reactive and relies on manual or custom queries; it cannot ensure exhaustive coverage of hidden or replicated stores and does not define a systematic deletion methodology. D. Training engineering teams on the importance of deleting user accounts and associated data – Training improves awareness but does not, by itself, guarantee that every copy of the data is located and erased; execution still depends on ad-hoc actions rather than a defined retention/disposition framework.Bottom line: Only a formally defined retention program creates a repeatable, cross-store, policy-driven deletion mechanism that can reliably eliminate all user-specific data after an account is removed.
IAPP, Data Subject Access Requests ( https://iapp.org/resources/article/data-subject-access-requests ) European Commission, Right to be Forgotten ( https://ec.europa.eu/info/law/law-topic/data-protection_en )
Which of the following CANNOT be effectively determined during a code audit?
Answer(s): C
Technical justificationOption C – “Whether consent is durably recorded in the case of a server crash.”This question addresses persistence of consent records across failure scenarios. Determining durability requires deep knowledge of the application’s storage engine, replication, and crash-recovery mechanisms, which are not visible from the code’s functional logic alone. It involves infrastructure design (e.g., transaction durability, log-based recovery) rather than code-level auditability. Consequently, it cannot be reliably verified during a pure code audit.Other options are analysable through code reviewOption A – “Whether access control logic is recommended in all cases.” The audit can scan authentication/authorization modules to verify that access-control checks are implemented comprehensively and correctly. Option B – “Whether data is being incorrectly shared with a third-party.” Code can be examined for data-exfiltration endpoints, outbound API calls, or logging of personal data that violate privacy policies. Option D – “Whether the differential privacy implementation correctly anonymizes data.” The algorithmic parameters ( ε , δ ) and noise-addition logic are part of the source code; they can be audited for mathematical correctness and compliance with privacy-by-design requirements.Hence, the only concern that cannot be effectively assessed solely by a code audit is the durability of consent storage after a crash, making C the correct answer.
IAPP, Certified Information Privacy Technologist (CIPT) Body of Knowledge, Section on Data Governance and Technical Audits – https://iapp.org/certify/cipt-body-of-knowledge/ ISO/IEC 27001:2022, Annex A.12.1 – Operational procedures for protecting personal data – https://www.iso.org/standard/75678.html
Post your Comments and Discuss IAPP CIPT exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the CIPT content, but please register or login to continue.