CDPSE Cheat Sheet 2026

The 30 highest-yield CDPSE facts, distilled from real exam questions. Print it, save it as a PDF, or study it here — free, no sign-up.

1. A breach involves the unauthorized disclosure of 50,000 patient records. The organization's DPA contact list is outdated. What risk does this create? → Missed regulatory notification deadlines due to inability to reach the correct authority
2. Which of the following is an example of 'pseudonymization' that still retains subject rights applicability? → Replacing names with codes where the mapping key is retained separately
3. What is the primary purpose of a 'tabletop exercise' in the context of privacy incident response? → To practice decision-making and coordination for hypothetical breach scenarios
4. In a DPIA, which control measure specifically addresses the risk of unauthorized internal access to sensitive personal data? → Role-based access control (RBAC) limiting data access to those with a legitimate need
5. What does the right to restriction of processing allow a data subject to do under GDPR? → Limit how the controller uses their data while a dispute is resolved
6. An organization is building a privacy governance committee. Which representation is MOST critical for effective privacy decision-making? → Cross-functional representation including legal, IT, HR, marketing, and operations
7. Under a mature privacy governance framework, who is ultimately accountable for organizational privacy risk? → The Board of Directors or senior executive leadership
8. A mobile app sends user location data to a third-party analytics SDK by default. What privacy principle does this MOST likely violate? → Privacy by design and by default
9. An organization allows users to opt out of data sharing but sets opt-in as the default. Does this satisfy the 'Privacy as the Default' principle? → No, because the most privacy-protective option must be the default
10. A CDPSE candidate is designing a data retention schedule. Which factor is MOST critical to determine first? → Legal and regulatory retention requirements
11. Which of the following is a leading indicator that privacy risk management processes are effective? → Reduction in the number of privacy risks escalated without treatment
12. Which element distinguishes a Privacy Impact Assessment (PIA) from a general risk assessment? → A PIA specifically evaluates risks to individuals' privacy rights and freedoms
13. A company uses an AI model trained on customer data to make credit decisions. Which privacy principle is MOST relevant to ensure fairness and transparency? → Right to explanation for automated decisions
14. Which of the following needs to be created first before a privacy office creates a campaign to raise awareness of data protection and privacy? → Strategic goals of the organization
15. What is the main function of a Consent Management Platform (CMP)? → To automate the collection, storage, and enforcement of user consent preferences
16. A DPIA identifies a risk that cannot be mitigated using current technology. What should the organization document in the DPIA report? → The unmitigated risk, the reasoning for acceptance, and senior management sign-off
17. The 'Respect for User Privacy' principle in Privacy by Design centers on which key concept? → Keeping privacy user-centric and empowering individuals
18. Which approach to user consent design best aligns with the 'Privacy as the Default' and 'Respect for User Privacy' principles combined? → Granular opt-in consent with plain language and easy withdrawal
19. A breach exposes hashed passwords with bcrypt. The organization concludes notification to data subjects is NOT required. What is the BEST justification? → Bcrypt hashing makes it unlikely that individuals face high risk
20. Which of the following scenarios BEST demonstrates the concept of 'data minimization' as a risk control? → Collecting only the personal data fields strictly necessary for the stated purpose
21. Which governance control ensures that employees across all business units understand their privacy responsibilities? → Role-based privacy awareness training and regular refreshers
22. An organization wants to implement data minimization. Which approach BEST achieves this principle? → Collect only the data strictly necessary for the specified purpose
23. Which design strategy best supports the 'End-to-End Security' Privacy by Design principle for data in transit? → Using TLS for all data transmissions between services
24. Under GDPR Article 25, Privacy by Design is legally required. Which action best demonstrates compliance with this obligation during product development? → Documenting privacy controls considered and integrated during the design phase
25. A privacy governance framework should ensure that privacy requirements are embedded into the system development lifecycle (SDLC) through which practice? → Privacy by Design integration at each SDLC phase
26. What does a data retention legal hold require an organization to do? → Suspend normal retention schedules and preserve relevant data for legal proceedings
27. A CDPSE candidate finds that an application stores passwords in plaintext in the database. This violates which Privacy by Design principle most directly? → Full Lifecycle Protection — End-to-End Security
28. In the context of federated learning, what is the primary privacy benefit compared to centralized machine learning? → Raw training data stays on local devices rather than being sent to a central server
29. An organization adopts ISO 29100 as part of its governance framework. Which of the following does ISO 29100 primarily provide? → A privacy framework defining principles and terminology for PII protection
30. When performing a Data Protection Impact Assessment (DPIA), what is the primary purpose of identifying risk owners? → To ensure accountability for treating or accepting identified privacy risks