- The General Data Protection Regulation (GDPR) applies to organizations that:
Answer: Are established in the EU, or - if not established in the EU - offer goods or services to, or monitor the behavior of, individuals located in the EU.
GDPR Article 3 establishes extraterritorial reach in two ways: it applies to organizations established in the EU (Article 3(1)), and to non-EU organizations that offer goods or services to, or monitor the behavior of, individuals located in the EU (Article 3(2)). Simply processing data of EU nationals outside this context is not sufficient to trigger GDPR. Answer D is correct. GDPR is not limited to EU-headquartered organizations alone (A), a transaction volume threshold (B), or financial industry organizations (C).
- A data broker buys users' location history from an app and pays with analytics services, not cash. Under CCPA, this is:
Answer: A sale; analytics have value
Paying with analytics services is valuable consideration, and CCPA defines a sale as transferring personal information for monetary or other valuable consideration. Cash isn't required, so this is a sale. The tempting wrong answer is 'a share; no cash changed hands' - a share does not apply because the transaction is an exchange for value, and lack of cash doesn't make it exempt.
- A company's privacy impact assessment (PIA) identifies that a new customer analytics system will process sensitive financial data at a large scale. Under GDPR, which additional requirement is most likely triggered?
Answer: A Data Protection Impact Assessment (DPIA) must be completed before the processing begins.
GDPR Article 35 requires a DPIA when processing is likely to result in high risk to individuals, such as large-scale processing of sensitive financial data. The DPIA must be completed before processing begins. Answer A is correct. Tax authority registration (B) is unrelated. Individual notification before go-live (C) is not a GDPR requirement. Infrastructure restrictions (D) are not prescribed by GDPR.
- The California Consumer Privacy Act (CCPA) grants California residents which of the following rights?
Answer: The right to know what personal information is collected, the right to delete it, and the right to opt out of its sale.
The CCPA grants California residents the right to know what personal information is collected and how it is used, the right to request deletion, and the right to opt out of the sale of their personal information. Answer C is correct. CCPA does not require 24-hour deletion (A), automatic compensation (B), or prior written consent for all data collection (D).
- Under GDPR, the 'right to erasure' (also known as the 'right to be forgotten') allows individuals to:
Answer: Request deletion of their personal data when it is no longer necessary, consent is withdrawn, or other specified conditions are met.
The right to erasure (GDPR Article 17) allows individuals to request deletion of their personal data under specific circumstances, including when the data is no longer needed or consent is withdrawn. Answer D is correct. Correcting inaccurate data (A) is the right to rectification. Accessing data (B) is the right of access. Restricting processing (C) is the right to restriction of processing.
- A retailer operates loyalty programs in California and collects customer purchase history. Under CCPA, if the retailer sells this data to third-party advertisers, it must:
Answer: Provide customers with a clear opt-out mechanism and disclose that their data is sold, such as a 'Do Not Sell My Personal Information' link.
CCPA requires businesses that sell personal information to disclose this practice and provide a prominent opt-out mechanism, such as the 'Do Not Sell My Personal Information' link. Answer C is correct. CCPA does not require explicit opt-in consent for data sales (A), encryption of sold data (B), or 12-month deletion (D).
- HIPAA's Privacy Rule primarily applies to which types of organizations?
Answer: Covered entities such as healthcare providers, health plans, and healthcare clearinghouses, and their business associates.
HIPAA's Privacy Rule applies specifically to covered entities (healthcare providers, health plans, clearinghouses) and their business associates who handle protected health information (PHI). Answer D is correct. HIPAA does not apply to all PII collectors (A), all organizations above a revenue threshold (B), or only government entities (C).
- Under GDPR, the principle of 'data minimization' requires that:
Answer: Personal data collected must be adequate, relevant, and limited to what is necessary for the specified purpose.
Data minimization is a core GDPR principle (Article 5) requiring that only data necessary for the stated purpose be collected and processed. Answer B is correct. Encryption requirements (A) relate to data security, not minimization. Limiting employee access (C) is the access control principle. Retention periods (D) relate to storage limitation, a separate GDPR principle.
- An organization's employee accidentally emails a file containing 50,000 customer records including names, addresses, and credit card numbers to an external party. Under GDPR, this event is best classified as:
Answer: A personal data breach requiring assessment for supervisory authority notification within 72 hours and potential notification to affected data subjects.
Unauthorized disclosure of personal data to an external party is a personal data breach under GDPR. Given the sensitivity (financial data) and volume (50,000 records), notification to the supervisory authority within 72 hours and likely to affected individuals is required. Answer A is correct. The number of affected individuals and data sensitivity preclude treating it as minor (B) or purely an IT matter (C). GDPR requires assessment and likely notification regardless of known misuse (D).
- Under GDPR, which of the following represents a lawful basis for processing personal data?
Answer: The data subject has given explicit, informed consent to the processing for a specified purpose.
GDPR Article 6 requires a lawful basis for processing, one of which is explicit, informed consent from the data subject for a specific purpose. Answer A is correct. A vague 'business interest' without necessity and proportionality analysis (B) does not satisfy the legitimate interests basis. Public posting (C) does not constitute consent for further processing. A broad privacy policy (D) is not a lawful basis under GDPR.
- An EU company hires an unrelated cloud provider in a country with no adequacy decision. Which GDPR mechanism applies?
Answer: Standard contractual clauses
The cloud provider is an unrelated recipient in a country with no adequacy decision, so you need a GDPR transfer mechanism that works between separate companies. Standard contractual clauses provide that safeguard. Binding corporate rules are the tempting wrong choice, but they only cover intra-group transfers, not an outside provider.
- Which of the following best describes the concept of 'Privacy by Design'?
Answer: An approach in which privacy protections are embedded into the design and architecture of systems and processes from the outset.
Privacy by Design, codified in GDPR Article 25, requires that data protection is considered and built into systems and processes from the earliest design stages rather than added as an afterthought. Answer B is correct. A reactive post-deployment approach (A) is the opposite of Privacy by Design. Annual audits (C) and encryption standards (D) are components of privacy programs but not the definition of Privacy by Design.
- A company transfers personal data of EU residents to a U.S.-based cloud provider. Under GDPR, which mechanism could legitimize this data transfer?
Answer: Standard Contractual Clauses (SCCs) approved by the European Commission.
GDPR Chapter V restricts personal data transfers to third countries. Approved mechanisms include SCCs, adequacy decisions, and Binding Corporate Rules. Standard Contractual Clauses are the most commonly used mechanism for transfers to the U.S. Answer A is correct. NDAs (B), internal policies (C), and audits (D) are not GDPR-recognized transfer mechanisms.
- Which of the following best describes the 'principle of integrity and confidentiality' under GDPR?
Answer: Personal data must be processed in a manner that ensures appropriate security, including protection against unauthorized access, loss, or destruction.
The integrity and confidentiality principle (GDPR Article 5(1)(f)) requires appropriate technical and organizational measures to protect personal data against unauthorized access, accidental loss, destruction, or damage. Answer D is correct. Data accuracy (A) relates to the accuracy principle. Disclosure notifications (B) relate to transparency. Separate consent per category (C) is not a GDPR requirement.
- The privacy principle of 'purpose limitation' means that:
Answer: Personal data collected for one specified purpose should not be used for a different, incompatible purpose without additional consent or lawful basis.
Purpose limitation requires that data be collected for specified, explicit, and legitimate purposes and not further processed in a manner incompatible with those purposes. Answer C is correct. There is no three-purpose limit (A). Retention limits (B) describe the storage limitation principle. Access limits (D) describe access control principles.
- A company collects biometric data from employees for building access control. Under GDPR, processing this data requires:
Answer: A specific lawful basis under Article 9 for special category data, such as explicit consent or necessity for employment law obligations.
Biometric data is a special category under GDPR Article 9, requiring a specific legal basis beyond the standard Article 6 bases - such as explicit consent or a basis under member state employment law. Answer B is correct. A standard privacy notice alone (A) is insufficient for special category data. Prior approval from authorities (C) is not a blanket requirement. 30-day anonymization (D) is not an GDPR requirement.
- Which of the following correctly describes the difference between 'data controller' and 'data processor' under GDPR?
Answer: A data controller determines the purposes and means of processing personal data; a data processor processes data on behalf of the controller.
Under GDPR, the data controller decides why and how personal data is processed (the decision-maker). The data processor acts on the controller's behalf and instructions. Answer C is correct. Answers A and B reverse the roles. They are distinct roles with different responsibilities and liabilities (D).
- Under HIPAA, 'protected health information' (PHI) is defined as:
Answer: Individually identifiable health information that is transmitted or maintained by a covered entity or business associate in any form.
HIPAA PHI is individually identifiable health information in any form (electronic, paper, oral) that is created, received, maintained, or transmitted by covered entities or business associates. Answer A is correct. PHI is not limited to electronic records (B), government agencies (C), or organizations above an employee threshold (D).
- A U.S.-based company receives a verifiable consumer request under CCPA to delete all personal information it has collected about the requestor. The company must respond within:
Answer: 45 days of receiving the request, with the option to extend by an additional 45 days with notice.
CCPA requires businesses to respond to verifiable consumer requests within 45 days. If more time is needed, an extension of up to 45 additional days is permitted with notice to the consumer. Answer B is correct. 24 hours (A), 90 days (C), and 30 days with no extension (D) are all incorrect timeframes under CCPA.
- The Payment Card Industry Data Security Standard (PCI DSS) is primarily concerned with:
Answer: Protecting cardholder data and ensuring secure processing, storage, and transmission of payment card information.
PCI DSS is a security standard established by major card brands to protect cardholder data across the payment ecosystem. Answer D is correct. PCI DSS focuses on cardholder data security, not general PII (A), health information (B), or retention schedules (C).
