Chapter 5: Risk Management and Data Protection

Which parameter measures the risk of unauthorized disclosure harming stakeholders' interests?

What is the primary goal of risk management within an organization?

What type of risk is associated with the quality or corruption of information?

Which of the following actions is NOT part of the risk management process?

In the context of risk management, what constitutes a risk?

Which parameter assesses the risk that information may not be accessible to intended users when needed?

What can happen to an organization that fails to manage its risks effectively?

What can be a consequence of viewing PDPA compliance merely as a legal exercise?

What characterizes leadership complacency regarding PDPA compliance?

Which of the following issues can result from improper training in an organization?

What impact does lack of oversight of third parties have on PDPA compliance?

Disjointed practices within an organization can lead to which of the following outcomes?

What is the primary purpose of a data classification policy?

Which element is NOT typically associated with a data classification policy?

When developing a data classification policy, who should be responsible for classifying data?

What is a key factor to consider for each data classification level?

How should protection measures correspond with data classification levels?

Which of the following is NOT a proposed level of data classification?

What role does data classification play in incident and security management procedures?

Which type of solutions should the information security requirements include?

What is one of the main benefits of a well-planned data classification policy?

What is an organization required to ensure when outsourcing data processing to a data intermediary?

What should an organization consider if a potential data intermediary is based outside of Singapore?

How should access to personal data be controlled within an organization?

What can lead to a failure to comply with the Protection Obligation?

What must organizations verify regarding personal data disclosures?

What should an organization's policy concerning personal data retention align with?

What type of risks are associated with involvement from third-party service vendors?

Which of the following is a common violation seen in enforcement decisions regarding the Protection Obligation?

What is critical for organizations to ensure when disposing of personal data?

Which of the following best describes the consequences of a lack of defined data classification policies?

What is a primary reason for the failures when engaging data intermediaries?

Which scenario exemplifies a failure due to insufficient data security measures by a data intermediary?

What continuous obligation does an organisation have when outsourcing data processing to a data intermediary?

Which of the following is NOT a factor to watch out for when engaging data intermediaries?

What is a potential risk involved in the electronic processing of personal data?

Which of the following indicates inadequate oversight by an organisation over a data intermediary?

What consequence may arise from a poor contract with a data intermediary?

Which of the following should be a standard practice for an organisation using data intermediaries?

What does the Protection Obligation entail for an organisation when engaging a data intermediary?

Which of the following practices should be avoided by data intermediary staff?

What are the three industry-recognized parameters of impact when data is compromised?

Why is data classification important? (Select all that apply)

What is risk management? (Select all that apply)

What are the 4 categories of risk?

What is the Transfer Limitation Obligation under the PDPA?

What are the possible risks or outcomes for failing to comply with the PDPA? (Select all that apply)

In the context of risk management, what is a threat (select all that apply)?

In the context of risk management, which of the following are examples of vulnerabilities? (Select all that apply)

A threat is something with the potential to do harm.

A vulnerability is a weakness, gap, or shortcoming that can be exploited by a threat – in other words, it can lead to a potentially harmful situation.

Which of the following statements about data classification are true? (Select all that apply)

Which of the following are examples of instances of non-compliance with the PDPA? (Select all that apply)

Which of the following are examples of instances of non-compliance with the PDPA? (Select all that apply)

What should a company look out for when engaging a data intermediary? (Select all that apply)

What is the difference between a 'cyber security incident' and a 'personal data breach'?

A risk assessment framework – also known as ‘risk rating/scoring’ – is a technique used to rate each individual risk based on a combination of which of the following factors?

What are the responsibilities of the DPO, after the risks have been ranked?

In some organizations, the PDPA Project Team and senior management are the same group of people or have a significant degree of overlap. In larger organizations, how does the PDPA Project Team typically relate to senior management?

What events should the DPO follow after the risk ranking report has been compiled? (Select all that apply)