Certified Information Privacy Manager (CIPM) — Question 18

Which of the following conditions will definitely trigger a Data Protection Impact Assessment (DPIA)?

Answer options

• A. When a company acquires a new business entity.
• B. When Human Resources engages a new employee benefit provider.
• C. When a new system is deployed to track an individual’s location or behavior.
• D. When a new application is developed to track data subject access requests.

Correct answer: C

Explanation

The correct answer is C because deploying a system that tracks an individual's location or behavior poses significant privacy risks, thus requiring a DPIA. Options A, B, and D may involve data processing but do not inherently involve high risks to individual privacy that would mandate a DPIA.