The primary reason for an organization to use hash functions when hardening application systems involved in biometric data processing is to reduce the risk of sensitive data breaches, because hash functions are one-way mathematical functions that transform biometric data into a unique and irreversible representation that cannot be reconstructed or reversed. This means that even if an attacker gains access to the hashed biometric data, they cannot use it to identify or impersonate the individual. Hash functions also help preserve the privacy and confidentiality of biometric data by preventing unauthorized access, modification, or disclosure.
Reference:
CDPSE Exam Content Outline, Domain 2 - Privacy Architecture (Privacy Architecture Implementation), Task 2: Implement privacy solutions1.
CDPSE Review Manual, Chapter 2 - Privacy Architecture, Section 2.3 - Privacy Architecture Implementation2.
CDPSE Certified Data Privacy Solutions Engineer All-in-One Exam Guide, Chapter 2 - Privacy Architecture, Section 2.4 - Remote Access3.

HTTP cookies are the standard mechanism used by websites to recognize returning visitors by storing a small piece of metadata on the user's browser. Flash cookies (D) and supercookies (A) exist but are not as common or compliant. Server cookies (C) are not a distinct browser-side identifier. The CDPSE emphasizes cookies as central to tracking, profiling, and consent requirements.
"Cookies... small data stored on a browser to recognize repeat visits and enable tracking."

The best approach for handling personal data that has been restricted is to flag users' email addresses to make sure they do not receive promotional information, because this will respect the users' preferences and rights to opt out of marketing communications. This will also help the company comply with the data protection laws and regulations that require consent and transparency for sending marketing emails, such as the General Data Protection Regulation (GDPR) and the CAN-SPAM Act12. The other options are not appropriate or sufficient for handling restricted data, because they may violate the users' rights, expectations, or agreements, or cause operational issues for the company.
Reference:
CDPSE Review Manual, Chapter 3 - Data Lifecycle, Section 3.1 - Data Classification3.
CDPSE Certified Data Privacy Solutions Engineer All-in-One Exam Guide, Chapter 3 - Data Lifecycle, Section 3.2 - Data Classification4.

A data use policy is a document that defines the rules and guidelines for how personal data are collected, used, stored, shared and deleted by an organization. It is an important part of data governance and compliance, as it helps to ensure that personal data are handled in a lawful, fair and transparent manner, respecting the rights and preferences of data subjects. A data use policy should include the requirements for collecting and using personal data, such as the legal basis, the purpose, the scope, the consent, the data minimization, the accuracy, the security and the accountability. These requirements help to establish the legitimacy and necessity of data processing activities, and to prevent unauthorized or excessive use of personal data.
Reference:
ISACA Privacy Notice & Usage Disclosures, section 2.1: "We collect Personal Information from you when you provide it to us directly or through a third party who has assured us that they have obtained your consent." Chapter Privacy Policy - Singapore Chapter - ISACA, section 2: "We will collect your personal data in accordance with the PDPA either directly from you or your authorized representatives, and/or through our third party service providers." Data Minimization-A Practical Approach - ISACA, section 2: "Enterprises may only collect as much data as are necessary for the purposes defined at the time of collection, which may also be set out in a privacy notice (sometimes referred to as a privacy statement, a fair processing statement or a privacy policy)." Establishing Enterprise Roles for Data Protection - ISACA, section 3: "Data governance is typically implemented in organizations through policies, guidelines, tools and access controls."

Anonymization (de-identification) is the PET that removes or irreversibly transforms identifiers so individuals are not identifiable, enabling safer secondary use and sharing. Controls like encryption in transit (D) and attribute-based access (C) restrict access or protect data in motion but do not prevent reidentification once data are accessed. Integrity checks (A) protect correctness, not privacy.
Key CDPSE-aligned phrasing (short extract): "Anonymization... renders personal data not identifiable to a data subject."