Noi questions

Podcast

Play an AI-generated podcast conversation about this lesson

Questions and Answers

The following are the four (4) steps in the DPMP program, list the four steps (a to d) in order:

Step 1 = Identify PD Handled Step 2 = Identify, Assess and Manage Risks Step 3 = Develop DPMP Step 4 = Maintain DPMP

Sam wanted to understand a bit more of DPMP's benefit. His classmate explained the benefits of organization to implement DPMP include the following key points, except for:

To help organisations develop, manage and maintain a robust data protection infrastructure.
To help foster a culture of data protection within the organisation.
To help an organization demonstrate accountability in data protection.
To provide ensure that organization don't need extra policies/process to comply with PDPC. (correct)

Under the People approach of DPMP, there is a need for training to develop general staff that could be as follows:

Educate staff on the PDPA and the organisation's data protection policies and processes

Make available data protection training materials in an accessible platform (eg intranet)

Rationalise business benefits of personal data protection.

Suggested topics include: Importance of Personal Data Protection. Identify which if the above points are "true" with regards to the training needs of staff.

Only 3 and 4
1, 2 and 3
1, 2 and 4 (correct)
All 1 to 4 are needed to training general staff.

For Process strategy under DPMP, the following points are used to ensure process is done well, except for:

Important to use PATO supplied by PDPC. (A) Signup and view all the answers

Which of the following risk is not associated with data protection:

Managing risk related to appointment of key personnel (B) Signup and view all the answers

As part of Data Breach Notification obligation, a data intermediary has the:

Duty to notify the data controller (A) Signup and view all the answers

Which of the following are options that the PDPC can take with regard to enforcement:

Voluntary undertaking

Suspension / discontinuation

Expedited breach decision

Full investigation

All 1 to 4 of the above (D) Signup and view all the answers

David, who is the HR Assistant Director of a manufacturing company, misplaced his company-issued hard-disk in his office premises on a Friday evening. The hard-disk, which has the label "Property of HR department" pasted on it, contains the entire database of their 800 employees' personal data. The cleaning lady, who comes in very early on Monday morning to clean up the office before the employees arrive, found the misplaced hard-disk and handed it to her supervisor who immediately returned it to the HR department. Who should the organization notify?

Do not need to notify PDPC or affected individuals (D) Signup and view all the answers

The Data Protection Impact Assessment can be conducted in six (6) phases. The first two phases are Phase 1 (Assess need for DPIA) and Phase 2 (Plan DPIA). Arrange the remaining four (4) phases in the correct sequence: a) Implement & Monitor Action Plan b) Identify Persona Data (PD) and PD Flows c) Create Action Plan d) Identify & Assess Data Protection Risks

b, d, c, a (C) Signup and view all the answers

One of the key strategies in DPMP is Policy where organization need to develop a personal data protection policy. Policies has life cycle with four (4) steps. List the steps in order of the life cycle of a DPMP:
a) Communicate policies to stakeholders. b) Get Management Approval for the policies c) Draft, review and revise the policies. d) Train staff and enforce policies.

c, b, a, d (B) Signup and view all the answers

The advantage of using a data flow diagram is:

it can be easily understood (C) Signup and view all the answers

In order to understand the data lifecycle, an organisation must:

analyse the flows of personal data in its business processes (B) Signup and view all the answers

When an organisation does something that may risk the breach of personal data, what kind of risk is it directly exposed to:

compliance risk (D) Signup and view all the answers

Personal Data Protection risk management is not:

registering Patent for a product (C) Signup and view all the answers

The risk level in terms of personal data protection may be determine by the following, except:

cost of implementing risk measures (D) Signup and view all the answers

One way in which an organisation can do scoring under a risk assessment framework is by using a quantitative approach or a qualitative approach

False (B) Signup and view all the answers

When an organisation put in controls to manage its risks, the organisation is responding to the risk by:

modifying the risk (A) Signup and view all the answers

In order to operationalise controls, it is necessary to lift a few simple rules out from the formal policies and practices and to present them to staff in a simple and straightforward set of requirements.

True (A) Signup and view all the answers

In order to comply with the purpose limitation obligation, employees could be instructed to:

collect only what is reasonable (D) Signup and view all the answers

The following are examples of administrative controls, except for:

restriction of access to organisation's premises (A) Signup and view all the answers

In order to comply with the PDPA where IT vendors are involved, the organisation must state clearly in the contract that:

the IT vendor is required to consider how personal data should be handled (C) Signup and view all the answers

The following are good data protection by design practices, except:

maximising the collection of personal data (C) Signup and view all the answers

As personal data protection is a continuous compliance process, which of the following statements is true

organisation should learn from feedback about its personal data protection policy (C) Signup and view all the answers

A Data Protection Policy on a website is mis-named. It is not a policy; it is a notice.

True (A) Signup and view all the answers

When drafting a notice, it is important to be clear and informative and:

use a simple style (B) Signup and view all the answers

Match the steps in the DPMP program in order:

Identify PD Handled = Step 1 Identify, Assess and Manage Risks = Step 2 Develop DPMP = Step 3 Maintain DPMP = Step 4 Signup and view all the answers

Sam was appointed a DPO recently in a Singapore organization. His classmate explained the benefits of organization to implement DPMP include the following key points, except for:

To provide ensure that organization don't need extra policies/process to comply with PDPC. (B) Signup and view all the answers

List the steps in order of the life cycle of a DPMP policy diagram:

Draft, review and revise the policies. = Step 1 Get Management Approval for the policies = Step 2 Train staff and enforce policies. = Step 3 Communicate policies to stakeholders. = Step 4 Signup and view all the answers

Under the People approach of DPMP, which of the following points are 'true' with regards to the training needs of staff?

1, 2 and 4 (B) Signup and view all the answers

Arrange the remaining four (4) phases in the correct sequence for Data Protection Impact Assessment:

Identify Persona Data (PD) and PD Flows = Phase 1 Identify & Assess Data Protection Risks = Phase 2 Create Action Plan = Phase 3 Implement & Monitor Action Plan = Phase 4 Signup and view all the answers

Which of the following are options that the PDPC can take with regard to enforcement:

All 1 to 4 of the above (D) Signup and view all the answers

Who should the organization notify in the scenario, where David misplaced his company-issued hard-disk containing the entire database of their 800 employees' personal data?

Do not need to notify PDPC or affected individuals (D) Signup and view all the answers

Flashcards

DPMP

A four-step program to establish a robust personal data protection infrastructure.

DPMP Steps (Order)

Identify PD Handled. 2. Identify, Assess and Manage Risks. 3. Develop DPMP. 4. Maintain DPMP.

DPMP Benefits

Organizations implement DPMP to demonstrate accountability, develop a data protection infrastructure, and foster a culture of data protection.

DPMP: Not a Replacement

To show compliance with PDPC extra policies are needed and do not replace any existing policies/processes.