Which best determines access privileges for customer personal data?

CDPSE By islever Editorial Last updated

Short answer

C Data classification

Question

Which of the following BEST helps to determine appropriate access privileges for an application containing customer personal data?
  1. Data catalog
  2. RACI charts
  3. Data classification Correct Answer
  4. Access control lists

Key Takeaways

The exam tests your understanding that data classification directly drives access control decisions for sensitive data, and the trap is confusing data catalogs or access control lists with classification.

Data classification is the best practice for determining appropriate access privileges for applications containing customer personal data, because it categorizes data by sensitivity and aligns access controls accordingly. The CDPSE community unanimously agrees that classification is the key first step before any access control design.

Common mistake: A common mistake is choosing 'Access control lists' because they directly grant permissions, but they only implement controls and do not help determine what the appropriate privileges should be; without classification, you cannot know which data needs stricter access.

Expert Analysis

Why the Answer Is Correct

Data classification is the process of categorizing data based on its sensitivity, confidentiality, and importance. For an application containing customer personal data, classification reveals which records are highly sensitive (e.g., financial, health, or identity data) and therefore require stricter access privileges. This directly supports the principle of least privilege by ensuring that users only access data necessary for their role. Community commenters emphasize that classification is foundational, with one noting it can be done using sensitivity levels like 'highly sensitive customer data may require stricter access controls'. Without classification, it is impossible to know which fields need additional protection.

Why the Other Options Are Wrong

A data catalog is a metadata inventory that describes data location and lineage, but it does not assign sensitivity levels or indicate how restrictive access should be. RACI charts assign roles and responsibilities for project tasks, not data access rights, and are irrelevant to defining access privileges for personal data. Access control lists are enforcement mechanisms that implement access rules once privileges are defined, but they do not help decide what those privileges should be; they are an output of the decision, not an input. The only option that provides the necessary sensitivity context for determining appropriate access is data classification.

Community Comment Notes

All community comments vote for C and describe data classification as categorizing data based on sensitivity and importance. One comment specifically states that classification 'helps determine the appropriate level of access privileges by aligning access controls with the sensitivity of the information,' and gives an example that highly sensitive customer data may require stricter access controls. No comment supports any other option, reinforcing the consensus. The comments also highlight the practical implication: classification informs data-handling rules and access decisions across the data lifecycle.

Official Reference

https://www.isaca.org/credentialing/cdpse

This link opens the official vendor documentation in a new tab.

Exam Strategy

On the CDPSE exam, always ask yourself whether the option defines or categorizes data versus merely enforcing or documenting access decisions. When you see a scenario involving customer personal data and 'appropriate access privileges,' think 'sensitivity first' — data classification is the foundational step that drives every subsequent access control decision.

Community Votes

C
100%

100% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 3 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 3

  1. 821bbab 👍 1
    Answer is C. Data classification is the process of categorizing data based on its sensitivity and importance. For applications containing customer personal data, classifying the data helps determine the appropriate level of access privileges by aligning access controls with the sensitivity of the information. For example, highly sensitive customer data may require stricter access controls, whereas less sensitive data might have more relaxed access policies. This ensures that only authorized individuals with a legitimate need can access sensitive personal data, minimizing the risk of unauthorized access or data breaches. D is not accurate since ACLs are lists that define which users or systems can access specific resources. Before creating ACLs, data classification must first be performed to determine which data requires higher protection. ACLs are a mechanism to enforce access once classification has been done.
  2. micro_cert 👍 1 Answered C
    Data classification involves categorizing data based on its sensitivity, confidentiality, and importance to the organization.
  3. 4dfe785 👍 1 Answered C
    C. Data classification

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

What Is the Greatest Privacy Concern with a Third-Party Virtualized Workspace?

S-grade

Data Migration with Outdated Documentation: What Should Be Done Next?

S-grade

Which Should Be the First Consideration in Data Sanitization Method Selection?

S-grade

Which scenario poses the greatest privacy risk: lacking hardware disposal policy or unencrypted internal emails?

S-grade

Practice All CDPSE Questions

Access 229 questions with complete answers and detailed explanations.

View Full CDPSE Practice Test →

← Back to CDPSE Study Guide