CDPSE Exam Dumps : Certified Data Privacy Solutions Engineer

A data use policy is a document that defines the rules and guidelines for how personal data are collected, used, stored, shared and deleted by an organization. It is an important part of data governance and compliance, as it helps to ensure that personal data are handled in a lawful, fair and transparent manner, respecting the rights and preferences of data subjects. A data use policy should include the requirements for collecting and using personal data, such as the legal basis, the purpose, the scope, the consent, the data minimization, the accuracy, the security and the accountability. These requirements help to establish the legitimacy and necessity of data processing activities, and to prevent unauthorized or excessive use of personal data.

References:

• ISACA Privacy Notice & Usage Disclosures, section 2.1: “We collect Personal Information from you when you provide it to us directly or through a third party who has assured us that they have obtained your consent.”
• Chapter Privacy Policy - Singapore Chapter - ISACA, section 2: “We will collect your personal data in accordance with the PDPA either directly from you or your authorized representatives, and/or through our third party service providers.”
• Data Minimization—A Practical Approach - ISACA, section 2: “Enterprises may only collect as much data as are necessary for the purposes defined at the time of collection, which may also be set out in a privacy notice (sometimes referred to as a privacy statement, a fair processing statement or a privacy policy).”
• Establishing Enterprise Roles for Data Protection - ISACA, section 3: “Data governance is typically implemented in organizations through policies, guidelines, tools and access controls.”

The notice provided to customers during data collection is the most important consideration when determining retention periods for personal data, as it reflects the transparency and accountability principles of privacy and the expectations and preferences of the data subjects. The notice should inform the customers about the purposes and legal bases of the data processing, the rights and choices of the customers, and the safeguards and measures to protect the data, including how long the data will be kept and when it will be deleted or disposed of. The notice should also be consistent with the applicable laws and regulations that may prescribe or limit the retention periods for certain types of personal data. The other options are not as important as the notice provided to customers during data collection when determining retention periods for personal data. Sectoral best practices for the industry may provide some guidance or benchmarks for retention periods, but they may not reflect the specific context or needs of the organization or the customers. Data classification standards may help to categorize data according to its sensitivity and value, but they may not indicate how long the data should be retained or deleted. Storage capacity available for retained data may affect the feasibility or cost of retaining data, but it should not determine or override the retention periods based on privacy principles, laws or customer expectations1, p. 99-100 References: 1: CDPSE Review Manual (Digital Version)

Implementing multi-factor authentication is the best way to reduce the risk of compromised credentials when an organization allows employees to have remote access, as it adds an extra layer of security and verification to the authentication process. Multi-factor authentication requires the user to provide two or more pieces of evidence to prove their identity, such as something they know (e.g., password, PIN), something they have (e.g., token, smart card), or something they are (e.g., fingerprint, face scan)135. References: 1 Domain 2, Task 8;