CDPSE By Design Principles 2 — Questions and Answers
Question 1: Which Privacy by Design principle requires that privacy protection remain effective even as systems evolve over time?
- Full Lifecycle Protection (Correct answer)
- Proactive not Reactive
- Privacy as the Default
- End-to-End Security
Correct answer: Full Lifecycle Protection
Full Lifecycle Protection ensures privacy safeguards are embedded from data collection through secure destruction, persisting across system changes.
Question 2: A development team wants to embed privacy controls into their agile sprint process rather than reviewing them at launch. This aligns with which Privacy by Design principle?
- Privacy as the Default Setting
- Proactive not Reactive; Preventative not Remedial (Correct answer)
- Respect for User Privacy
- Visibility and Transparency
Correct answer: Proactive not Reactive; Preventative not Remedial
Proactive not Reactive means anticipating and preventing privacy events before they occur rather than responding after the fact.
Question 3: An organization allows users to opt out of data sharing but sets opt-in as the default. Does this satisfy the 'Privacy as the Default' principle?
- Yes, because users can always change their settings
- No, because the most privacy-protective option must be the default (Correct answer)
- Yes, because opt-out provides sufficient user control
- No, because privacy settings should not be configurable
Correct answer: No, because the most privacy-protective option must be the default
Privacy as the Default requires that the strongest privacy protections apply automatically without any user action.
Question 4: Which Privacy by Design foundational principle directly rejects the idea that privacy and security are mutually exclusive?
- Proactive not Reactive
- Full Functionality — Positive-Sum, not Zero-Sum (Correct answer)
- End-to-End Security
- Privacy Embedded into Design
Correct answer: Full Functionality — Positive-Sum, not Zero-Sum
Full Functionality rejects false either/or trade-offs, asserting that privacy and security (or privacy and functionality) can both be fully achieved.
Question 5: A CDPSE candidate is reviewing a system that logs all user activity by default and requires users to disable logging themselves. Which principle is most clearly violated?
- End-to-End Security
- Privacy as the Default Setting (Correct answer)
- Visibility and Transparency
- Respect for User Privacy
Correct answer: Privacy as the Default Setting
Privacy as the Default requires that data minimization and privacy protections are automatic, not requiring user action to activate.
Question 6: When Privacy by Design says it should be 'embedded into design,' what does this primarily mean for software architects?
- Privacy features are added as plugins after development
- Privacy controls are bolted on during the testing phase
- Privacy is integrated as a core component of the system architecture (Correct answer)
- Privacy compliance is handled exclusively by legal teams
Correct answer: Privacy is integrated as a core component of the system architecture
Embedding privacy into design means it is a core architectural element, not an afterthought or add-on layer.
Question 7: The 'Respect for User Privacy' principle in Privacy by Design centers on which key concept?
- Minimizing regulatory compliance costs
- Keeping privacy controls hidden from users to avoid confusion
- Keeping privacy user-centric and empowering individuals (Correct answer)
- Delegating privacy decisions entirely to system administrators
Correct answer: Keeping privacy user-centric and empowering individuals
Respect for User Privacy means the system is designed around the individual's interests, giving users strong defaults, notice, and meaningful control.
CDPSE By Design Principles 2
Which Privacy by Design principle requires that privacy protection remain effective even as systems evolve over time?