CDPSE Data Lifecycle Management 1 — Questions and Answers
Question 1: Which principle requires that personal data be kept only as long as necessary for its original collection purpose?
- Data minimization
- Storage limitation (Correct answer)
- Purpose limitation
- Accuracy
Correct answer: Storage limitation
The storage limitation principle, recognized in GDPR and other frameworks, mandates that personal data must not be retained beyond the period necessary for its specified purpose.
Question 2: What is the BEST method for ensuring that personal data is irreversibly destroyed at the end of its retention period?
- Deleting the file from the folder
- Overwriting data with random bits multiple times (Correct answer)
- Moving data to an archive folder
- Changing file permissions to restrict access
Correct answer: Overwriting data with random bits multiple times
Cryptographic erasure or multi-pass overwriting renders data unrecoverable, meeting the standard for irreversible destruction under data protection regulations.
Question 3: A CDPSE candidate is designing a data retention schedule. Which factor is MOST critical to determine first?
- Available storage capacity
- Legal and regulatory retention requirements (Correct answer)
- Cost of storage media
- User access frequency
Correct answer: Legal and regulatory retention requirements
Legal and regulatory requirements set the minimum and maximum retention periods that override business convenience or cost considerations.
Question 4: During which data lifecycle phase is the Privacy Impact Assessment (PIA) MOST effectively initiated?
- Data disposal phase
- Data collection phase (Correct answer)
- Data archiving phase
- Data analysis phase
Correct answer: Data collection phase
Initiating a PIA during the data collection design phase allows privacy risks to be mitigated before personal data is ever gathered.
Question 5: Which data lifecycle stage presents the HIGHEST risk of unauthorized re-identification?
- Data creation
- Data storage
- Data disposal (Correct answer)
- Data sharing
Correct answer: Data disposal
Improper disposal—such as discarding unwiped storage media—can expose de-identified or supposedly deleted personal data to re-identification by unauthorized parties.
Question 6: What is 'data mapping' in the context of the personal data lifecycle?
- Encrypting data as it flows between systems
- Documenting where personal data originates, moves, and is stored across the organization (Correct answer)
- Converting data from one format to another
- Backing up data to multiple geographic locations
Correct answer: Documenting where personal data originates, moves, and is stored across the organization
Data mapping creates a comprehensive inventory of personal data flows, which is foundational to demonstrating compliance and identifying privacy risks.
CDPSE Data Lifecycle Management 1
Which principle requires that personal data be kept only as long as necessary for its original collection purpose?