Data Lifecycle Management Flashcards

What is a Record of Processing Activities (RoPA) primarily used for?

Answer: Documenting all personal data processing operations within an organization

A RoPA is a compliance document required under GDPR Article 30 that records the purposes, categories, and flows of all personal data processing activities.

Which of the following BEST describes 'data provenance' in the context of privacy?

Answer: The origin and chain of custody of data throughout its lifecycle

Data provenance tracks where data came from, how it was transformed, and who handled it, supporting accountability and auditability.

An organization wants to repurpose customer purchase history for an AI training dataset. What privacy step must occur FIRST?

Answer: Assess whether the new use is compatible with the original collection purpose

A compatibility assessment and, if needed, obtaining a new legal basis or fresh consent is required before data can be repurposed for a materially different use.

Which sanitization standard is MOST commonly referenced for the secure disposal of US government data on magnetic media?

Answer: NIST SP 800-88

NIST SP 800-88 'Guidelines for Media Sanitization' provides the authoritative US standard for clearing, purging, and destroying data on various media types.

What does a data retention legal hold require an organization to do?

Answer: Suspend normal retention schedules and preserve relevant data for legal proceedings

A legal hold overrides standard deletion schedules, requiring organizations to preserve all potentially relevant data until the legal matter is resolved.

Why is data lineage documentation important for CDPSE professionals?

Answer: It enables organizations to trace data transformations and demonstrate compliance accountability

Data lineage provides an auditable record of how personal data has been processed and transformed, which is essential for regulatory accountability and breach investigations.