Which best determines access privileges for customer personal data?
Which of the following BEST helps to determine appropriate access privileges for an application containing customer personal data?
Community Votes
100% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The exam tests your understanding that data classification directly drives access control decisions for sensitive data, and the trap is confusing data catalogs or access control lists with classification.
Data classification is the best practice for determining appropriate access privileges for applications containing customer personal data, because it categorizes data by sensitivity and aligns access controls accordingly. The CDPSE community unanimously agrees that classification is the key first step before any access control design.
A common mistake is choosing 'Access control lists' because they directly grant permissions, but they only implement controls and do not help determine what the appropriate privileges should be; without classification, you cannot know which data needs stricter access.
Community Discussion (3 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Data classification is the process of categorizing data based on its sensitivity, confidentiality, and importance. For an application containing customer personal data, classification reveals which records are highly sensitive (e.g., financial, health, or identity data) and therefore require stricter access privileges. This directly supports the principle of least privilege by ensuring that users only access data necessary for their role. Community commenters emphasize that classification is foundational, with one noting it can be done using sensitivity levels like 'highly sensitive customer data may require stricter access controls'. Without classification, it is impossible to know which fields need additional protection.
Why the Other Options Are Wrong
A data catalog is a metadata inventory that describes data location and lineage, but it does not assign sensitivity levels or indicate how restrictive access should be. RACI charts assign roles and responsibilities for project tasks, not data access rights, and are irrelevant to defining access privileges for personal data. Access control lists are enforcement mechanisms that implement access rules once privileges are defined, but they do not help decide what those privileges should be; they are an output of the decision, not an input. The only option that provides the necessary sensitivity context for determining appropriate access is data classification.
Community Comment Notes
All community comments vote for C and describe data classification as categorizing data based on sensitivity and importance. One comment specifically states that classification 'helps determine the appropriate level of access privileges by aligning access controls with the sensitivity of the information,' and gives an example that highly sensitive customer data may require stricter access controls. No comment supports any other option, reinforcing the consensus. The comments also highlight the practical implication: classification informs data-handling rules and access decisions across the data lifecycle.
Official Reference
Exam Strategy
On the CDPSE exam, always ask yourself whether the option defines or categorizes data versus merely enforcing or documenting access decisions. When you see a scenario involving customer personal data and 'appropriate access privileges,' think 'sensitivity first' — data classification is the foundational step that drives every subsequent access control decision.
Related Analysis
Practice All CDPSE Questions
Access 229 questions with complete answers and detailed explanations.
View Full CDPSE Practice Test →