Discuss Isaca CDPSE Exam Topic 2 Question 70

Which of the following should be the FIRST consideration when conducting a privacy impact assessment (PIA)?

AThe applicable privacy legislation

BThe quantity of information within the scope of the assessment

CThe systems in which privacy-related data is stored

DThe organizational security risk profile

Suggested Answer: A

The first consideration when conducting a privacy impact assessment (PIA) is the applicable privacy legislation that governs the collection, processing, storage, transfer, and disposal of personal data within the scope of the assessment. The applicable privacy legislation may vary depending on the jurisdiction, sector, or purpose of the data processing activity. The PIA should identify and comply with the relevant legal requirements and obligations for data protection and privacy, such as obtaining consent, providing notice, ensuring data quality and security, respecting data subject rights, and reporting data breaches. The applicable privacy legislation also determines the criteria, methodology, and documentation for conducting the PIA.

ISACA, Performing an Information Security and Privacy Risk Assessment1

ISACA, Best Practices for Privacy Audits2

ISACA, GDPR Data Protection Impact Assessments3

ISACA, GDPR Data Protection Impact Assessment Template4

Get Premium CDPSE Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

21 comments · newest first

Han 9 months ago

Wait, are we sure legislation is the first step? Seems off.

Stephen 10 months ago

Totally agree, legislation is key.

Milly 10 months ago

I think the quantity of info matters too, though.

Vincent 10 months ago

The security risk profile should be top priority, right?

Lacresha 11 months ago

Gotta start with the applicable privacy legislation!

Ming 11 months ago

The organizational security risk profile seems relevant, but I thought we usually start with the legal requirements in PIAs.

Pearlene 11 months ago

I feel like the quantity of information might be important too, but I can't recall if it should come before the legislation.

Arlyne 11 months ago

I remember a practice question that emphasized understanding the systems where data is stored first. Maybe that's what we should focus on?

Angella 12 months ago

I think the first consideration should be the applicable privacy legislation, but I'm not entirely sure if that's the most critical factor.

Moon 12 months ago

I'm a little confused on this one. I know a PIA is about identifying and mitigating privacy risks, but I'm not sure if the legislation is the absolute first thing to look at. The systems and data involved might be a good starting point too. I'll have to think this through carefully.

Dana 12 months ago

The applicable privacy legislation is definitely the most important consideration when doing a PIA. That's going to set the framework for the whole assessment, so I'm pretty confident that's the right answer here.

Denae 1 year ago

Hmm, I'm a bit unsure about this one. There are a few different factors to consider when doing a PIA, so I'm not sure if the legislation should be the very first thing. Maybe the quantity of information or the systems involved would be a better starting point.

Anastacia 1 year ago

This seems like a straightforward question about conducting a privacy impact assessment. I think the key is to focus on the first step, which is understanding the applicable privacy legislation.

Timmy 1 year ago

But what about the quantity of information? Shouldn't that be considered first?

Dorethea 1 year ago

I agree with Van, because the legislation sets the framework for the assessment.

Rosio 1 year ago

Option A seems obvious to me. You can't conduct a PIA without first understanding the relevant privacy laws.

Amber 9 months ago

↳ replying to Rosio

Still, laws should come first. They set the foundation.

Basilia 9 months ago

↳ replying to Rosio

But what about the data quantity? That matters too.

Bettina 10 months ago

↳ replying to Rosio

True, without knowing the laws, how can we assess anything?

Carlee 10 months ago

↳ replying to Rosio

I agree, option A is crucial. Laws guide the whole process.

Van 1 year ago

I think the first consideration should be the applicable privacy legislation.

Isaca CDPSE Exam - Topic 2 Question 70 Discussion