Quiz DSCI Certified Privacy Lead Assessor

FILL BLANK
VPI
As a starting point, the consultants undertook a visibility exercise to understand the type of personal
information (PI) being dealt with within the organization and also by third parties and the scope was
to cover all the client relationships (IT services and BPM both) and functions. They met with the
client relationship and business function owners to collect this dat
a. The consultants did a mapping exercise to identify PI and associated attributes including whether
company directly collects the PI, how it is accessed, transmitted, stored and what are the applicable
regulatory and contractual requirements. Given the enormous scale of the exercise (enterprise
wide), the consultant classified the PI as financial information, health related information, personally
identifiable information, etc. and collected the rest of the attributes against this classification. When



understanding the underlying technology environment, the consultants restricted themselves only to
the technology environment that was under company’s ownership and premises and did not
continue the exercise for client side environment. This was done because relationship owners
seemed reluctant to share such client specific details. Only in 2 relationships, were the relationship
heads proactive to introduce the consultants to the clients and get the requisite information. The
analysis of the environment in these 2 relationships revealed that even though lots of restrictions
were imposed at the company side, the same restrictions were not available at the client side.
Many business functions were also availing services from third party service providers. Though these
functions were aware of the type of PI dealt by third parties, they were not aware of the technology
environment at the third parties. In one odd case, personal information of a company employee was
accidentally leaked by the employee of the third party through the social networking site. The
consultants relied on whatever information was provided by the functions w.r.t. third parties. After
finishing the data collection, the consultant used the information to create information flow maps
highlighting the flow of information across systems deployed at the company premises. This work
helped them have a high level view of PI dealt by the company. The data collection exercise has been
conducted only once by the consultants. The visibility exercise empowered the management to have
a company-wide view of PI and how it flows across the organization. This information was coupled
with the security controls / practices deployed at the relationship or function level to derive the risk
posture of the PI.
(Note: Candidates are requested to make and state assumptions wherever appropriate to reach a
definitive conclusion)
Introduction and Background
XYZ is a major India based IT and Business Process Management (BPM) service provider listed at BSE
and NSE. It has more than 1.5 lakh employees operating in 100 offices across 30 countries. It serves
more than 500 clients across industry verticals — BFSI, Retail, Government, Healthcare, Telecom
among others in Americas, Europe, Asia-Pacific, Middle East and Africa. The company provides IT
services including application development and maintenance, IT Infrastructure management,
consulting, among others. It also offers IT products mainly for its BFSI customers.
The company is witnessing phenomenal growth in the BPM services over last few years including
Finance & Accounting including credit card processing, Payroll processing, Customer support, Legal
Process Outsourcing, among others and has rolled out platform based services. Most of the
company’s revenue comes from the US from the BFSI sector. In order to diversify its portfolio, the
company is looking to expand its operations in Europe. India, too has attracted company’s attention
given the phenomenal increase in domestic IT spend esp. by the government through various large
scale IT projects.
The company is also very aggressive in the cloud and mobility space, with a strong focus on delivery
of cloud services. When it comes to expanding operations in Europe, company is facing difficulties in
realizing the full potential of the market because of privacy related concerns of the clients arising
from the stringent regulatory requirements based on EU General Data Protection Regulation (EU
GDPR).
To get better access to this market, the company decided to invest in privacy, so that it is able to
provide increased assurance to potential clients in the EU and this will also benefit its US operations
because privacy concerns are also on rise in the US. It will also help company leverage outsourcing
opportunities in the Healthcare sector in the US which would involve protection of sensitive medical
records of the US citizens. The company believes that privacy will also be a key differentiator in the
cloud business going forward. In short, privacy was taken up as a strategic initiative in the company
in early 2011.
Since XYZ had an internal consulting arm, it assigned the responsibility of designing and



implementing an enterprise wide privacy program to the consulting arm. The consulting arm had
very good expertise in information security consulting but had limited expertise in the privacy
domain. The project was to be driven by CIO's office, in close consultation with the Corporate
Information Security and Legal functions.
Was the visibility exercise adequately carried out? What gaps did you notice? (250 to 500 words)

answer in
explanation below.

Calls for inclusion of data protection from the onset of the designing of systems.

Which of the following are classified as Sensitive Personal Data or Information under Section 43A of
ITAA, 2008? (Choose all that apply.)

Entities should collect personal information from user that is adequate, relevant and limited to what
is necessary in relation to the purposes for which they are processed. This Privacy Principle is called:

The method of personal data usage in which the users must explicitly decide not to participate.

An entity shall retain personal data only as long as may be reasonably necessary to satisfy the
purpose for which it is processed; or with respect to an established retention period. This privacy
principle is known as?

What are the Nine Privacy Principles as described in DSCI Privacy Framework (DPF©)?
I) Use Limitation
II) Accountability
III) Data Quality
IV) Notice
V) Preventing Harm
VI) Choice & Consent
VII) Access and Correction
VIII) Data Minimization
IX) Openness
X) Disclosure to Third Parties
XI) Right to be Forgotten
XII) Collection limitation
XIII) Security

The concept of data adequacy is based on the principle of .

What is a Data Controller?

What is a Data Subject? (Choose all that apply.)