Isaca Certification CDPSE Passing Score

When contracting with a SaaS provider, it is important to ensure that the provider will remove all customer data from their systems and storage devices at the end of the service contract. This will prevent any unauthorized access, use, or disclosure of the customer data by the provider or third parties after the service termination. Removal of customer data means that the data are permanently erased and cannot be recovered or restored by any means.

References:

• ISACA, Data Privacy Audit/Assurance Program, Control Objective 9: Data Disposal, p. 16-171
• ISACA, CDPSE Review Manual 2021, Chapter 4: Privacy Incident Response, Section 4.2: Data Disposal and Destruction, p. 151-152.

Data privacy and data security are related but distinct concepts that are both essential for protecting personal data. Data privacy is about ensuring that personal data are collected, used, shared and disposed of in a lawful, fair and transparent manner, respecting the rights and preferences of the data subjects. Data privacy also involves implementing policies, procedures and controls to comply with data protection laws and regulations, such as the General Data Protection Regulation (GDPR) or the California Consumer Privacy Act (CCPA). Data privacy protects users from unauthorized disclosure of their personal data, which may result in harm, such as identity theft, fraud, discrimination or reputational damage.

Data security is about safeguarding the confidentiality, integrity and availability of data from unauthorized or malicious access, use, modification or destruction. Data security also involves implementing technical and organizational measures to prevent or mitigate data breaches or incidents, such as encryption, authentication, backup or incident response. Data security prevents compromise of data, which may result in loss, corruption or disruption of data.

References:

• The Difference Between Data Privacy and Data Security - ISACA, section 1: “Data privacy is focused on the use and governance of personal data—things like putting policies in place to ensure that consumers’ personal information is being collected, shared and used in appropriate ways.”
• Practical Data Security and Privacy for GDPR and CCPA - ISACA, section 1: “Data security is the practice of protecting digital information from unauthorized access, corruption or theft throughout its life cycle.”

A data processor that handles personal data for multiple customers has decided to migrate its data warehouse to a third-party provider. The processor is obligated to seek approval from all in-scope data controllers prior to implementation. A data controller is an entity that determines the purposes and means of processing personal data. A data processor is an entity that processes personal data on behalf of a data controller. A third-party provider is an entity that provides services or resources to another entity, such as a cloud service provider or a hosting provider.

According to various privacy laws and regulations, such as the GDPR or the CCPA, a data processor must obtain explicit consent from the data controller before engaging another processor or transferring personal data to a third country or an international organization. The consent must specify the identity of the other processor or the third country or international organization, as well as the safeguards and guarantees for the protection of personal data. The consent must also be documented in a written contract or other legal act that binds the processor to respect the same obligations as the controller.

Seeking approval from all in-scope data controllers can help ensure that the processor complies with its contractual and legal obligations, respects the rights and preferences of the data subjects, and maintains transparency and accountability for its processing activities.

Obtaining assurance that data subject requests will continue to be handled appropriately, implementing comparable industry-standard data encryption in the new data warehouse, or ensuring data retention periods are documented are also good practices for a data processor that migrates its data warehouse to a third-party provider, but they are not obligations prior to implementation. Rather, they are requirements or recommendations during or after implementation.

Obtaining assurance that data subject requests will continue to be handled appropriately is a requirement for a data processor that processes personal data on behalf of a data controller. Data subject requests are requests made by individuals to exercise their rights regarding their personal data, such as access, rectification, erasure, restriction, portability, or objection. A data processor must assist the data controller in fulfilling these requests within a reasonable time frame and without undue delay.

Implementing comparable industry-standard data encryption in the new data warehouse is a recommendation for a data processor that transfers personal data to another system or location. Data encryption is a process of transforming data into an unreadable form using a secret key or algorithm. Data encryption can help protect the confidentiality, integrity, and availability of personal data by preventing unauthorized access, disclosure, or modification.

Ensuring data retention periods are documented is a requirement for a data processor that stores personal data on behalf of a data controller. Data retention periods are the durations for which personal data are kept before they are deleted or anonymized. Data retention periods must be determined by the purpose and necessity of processing personal data and must comply with legal and regulatory obligations.

References: Data warehouse migration tips: preparation and discovery - Google Cloud, Plan a data warehouse migration - Cloud Adoption Framework, Migrating your traditional data warehouse platform to BigQuery …

Performing a full wipe and reimage of the laptops is the best control to prevent the exposure of personal information when redeploying laptops within an organization. This is because a full wipe and reimage ensures that all data, including personal information, is securely erased from the laptops and replaced with a fresh installation of the operating system and applications. This reduces the risk of data leakage, unauthorized access, or data recovery by malicious actors or unauthorized users. The other options are not as effective or sufficient as a full wipe and reimage, as they do not guarantee the complete removal of personal information from the laptops.

References: CDPSE Review Manual, 2021, p. 147