Isaca CDPSE Exam Dumps

Lawfulness and fairness is a data protection principle that states that personal data should be processed in a lawful, fair, and transparent manner in relation to the data subject. This means that personal data should be collected and used for legitimate purposes that are specified and communicated to the data subject, and that respect the rights and interests of the data subject. By posting its customer data protection notice that includes a statement indicating information is collected on how products are used, the content viewed, and the time and duration of online activities, an online business is applying the lawfulness and fairness principle. The online business is informing the customers about the purpose and scope of data collection, and obtaining their consent or legal basis for processing their personal data.Reference:: CDPSE Review Manual (Digital Version), page 2

The strategic goals of the organization should be established first before a privacy office starts to develop a data protection and privacy awareness campaign, because they provide the direction, purpose, and scope of the campaign. The strategic goals of the organization reflect its vision, mission, values, and objectives, as well as its alignment with the relevant privacy laws and regulations, stakeholder expectations, and industry best practices. The privacy office should design and implement the awareness campaign in a way that supports and promotes the strategic goals of the organization, as well as measures and evaluates its effectiveness and impact.

CDPSE Review Manual, 2023 Edition, Domain 1: Privacy Governance, Section 1.1.2: Privacy Strategy Implementation, p. 19

CDPSE Review Manual, 2023 Edition, Domain 1: Privacy Governance, Section 1.3.2: Privacy Awareness and Training Program, p. 38-39

ICO launches data awareness campaign1

The applicable privacy legislation needs to be identified first to define the privacy requirements to use when assessing the selection of IT systems, because it sets the legal obligations and standards for the organization to comply with when processing personal data. The type of data, the control frameworks, and the technology platforms are all dependent on the privacy legislation that applies to the organization and its data processing activities. Therefore, the privacy legislation is the primary source of privacy requirements for IT systems.

CDPSE Review Manual, 2023 Edition, Domain 2: Privacy Architecture, Section 2.1.2: Privacy Requirements, p. 75

Compliance with Cybersecurity and Privacy Laws and Regulations1

After a privacy risk has been accepted, the next step is to monitor the risk landscape for material changes. This means that the organization should keep track of any internal or external factors that may affect the likelihood or impact of the risk, such as new threats, vulnerabilities, regulations, technologies, or business processes. Monitoring the risk landscape can help the organization identify if the risk acceptance decision is still valid, or if it needs to be revisited or revised. Monitoring can also help the organization prepare for potential incidents or consequences that may arise from the accepted risk.

The most effective way to incorporate privacy by design principles into applications is to include privacy requirements in software development practices, because this ensures that privacy is considered and integrated from the early stages of the design process and throughout the entire lifecycle of the application. Software development practices include activities such as defining the scope, objectives, and specifications of the application, identifying and analyzing the privacy risks and impacts, selecting and implementing the appropriate privacy-enhancing technologies and controls, testing and validating the privacy functionality and performance, and monitoring and reviewing the privacy compliance and effectiveness of the application. By including privacy requirements in software development practices, the organization can achieve a proactive, preventive, and embedded approach to privacy that aligns with the privacy by design principles.

CDPSE Review Manual, 2023 Edition, Domain 2: Privacy Architecture, Section 2.1.2: Privacy Requirements, p. 75

CDPSE Review Manual, 2023 Edition, Domain 2: Privacy Architecture, Section 2.2.1: Privacy by Design Methodology, p. 79-80

The 7 Principles of Privacy by Design | Blog | OneTrust1