Explanation
The first consideration when conducting a privacy impact assessment (PIA) is the applicable privacy legislation that governs the collection, processing, storage, transfer, and disposal of personal data within the scope of the assessment. The applicable privacy legislation may vary depending on the jurisdiction, sector, or purpose of the data processing activity. The PIA should identify and comply with the relevant legal requirements and obligations for data protection and privacy, such as obtaining consent, providing notice, ensuring data quality and security, respecting data subject rights, and reporting data breaches. The applicable privacy legislation also determines the criteria, methodology, and documentation for conducting the PIA.
References:
* ISACA, Performing an Information Security and Privacy Risk Assessment1
* ISACA, Best Practices for Privacy Audits2
* ISACA, GDPR Data Protection Impact Assessments3
* ISACA, GDPR Data Protection Impact Assessment Template4

Explanation
The best way to validate that privacy practices align to the published enterprise privacy management program is to conduct an audit. An audit is an independent and objective examination of evidence to provide assurance that privacy practices are effective and compliant with the enterprise privacy management program. An audit can also identify any gaps or weaknesses in the privacy practices and provide recommendations for improvement. An audit can be conducted internally or externally, depending on the scope, objectives, and standards of the audit. References: : CDPSE Review Manual (Digital Version), page 83

Explanation
Application hardening measures are the most important action to protect a mobile banking app and its data against manipulation and disclosure because they prevent attackers from reverse engineering, tampering, or injecting malicious code into the app. Application hardening measures include techniques such as code obfuscation, encryption, integrity checks, anti-debugging, and anti-tampering mechanisms. These measures make the app more resilient and secure against various types of cyberattacks.
References:
* ISACA Certified Data Privacy Solutions Engineer Study Guide, Domain 3: Privacy Engineering, Task
3.4: Implement privacy engineering techniques to protect data in applications and systems, p. 104-105.
* What is Application Hardening? | Glossary | Digital.ai

Explanation
Data masking is the process of hiding original data with modified content to protect sensitive data from unauthorized access or disclosure. Data masking is often used for testing purposes in non-production environments, where personal data is not needed or allowed. However, data masking can pose several challenges, especially for a global financial institution that has multiple interconnected systems and applications. One of the greatest challenges is to preserve the complex relationships within and across systems while masking the data. This means that the masked data must maintain the same format, referential integrity, semantic integrity, and uniqueness as the original data, so that the testing results are valid and reliable. For example, if a customer's name is masked in one system, it must be masked consistently in all other systems that reference it. If a transaction amount is masked in one system, it must not violate any business rules or constraints in another system. If a credit card number is masked in one system, it must still be a valid credit card number in another system. Preserving these complex relationships can be challenging because it requires a thorough understanding of the data model, the business logic, and the dependencies among systems. It also requires a robust and flexible data masking tool that can handle different types of data and platforms.