CPA Quiz: Apply Data Privacy Principles And Regulations

What this quiz covers

This quiz focuses on Apply Data Privacy Principles And Regulations, giving you a quick way to practice the rules, question types, and explanations that matter most for CPA.

How to use this quiz

Try each quiz question before looking at the correct answer. Use the explanations to review missed ideas, then come back to similar questions until the pattern feels familiar.

Question 1

1. Obtain explicit written consent from each customer before any data sale.
2. Encrypt all purchase history data before transferring it to advertisers.
3. Provide customers with a clear opt-out mechanism and disclose that their data is sold, such as a 'Do Not Sell My Personal Information' link. (correct answer)
4. Delete all purchase history data within 12 months of collection.

Question 2

1. Any organization collects personal data from more than 100 individuals.
2. The organization is a public authority, or its core activities involve large-scale systematic monitoring of individuals or large-scale processing of special categories of data. (correct answer)
3. The organization operates in more than one EU member state.
4. The organization's annual revenue exceeds €50 million.

Question 3

1. Consent and authorization rule
2. Minimum necessary standard (correct answer)
3. Notice of privacy practices
4. Accounting of disclosures rule

Question 4

1. Legitimate interest, balanced (correct answer)
2. Consent at account opening
3. Contract performance duty
4. Task in the public interest

Question 5

1. Privacy Shield certification
2. Binding corporate rules (BCRs)
3. Explicit consent of the user
4. Standard contractual clauses (correct answer)

Question 6

1. Data minimization
2. Purpose limitation (correct answer)
3. Storage limitation
4. Accuracy principle

Question 7

1. A share; no cash changed hands
2. A business-purpose disclosure
3. A sale; analytics have value (correct answer)
4. An exempt business transfer

Question 8

1. 72 hours of becoming aware of the breach, where feasible. (correct answer)
2. 30 days of the breach being discovered.
3. 24 hours of the breach occurring.
4. 7 business days of confirming the breach through a formal investigation.

Question 9

1. A personal data breach requiring assessment for supervisory authority notification within 72 hours and potential notification to affected data subjects. (correct answer)
2. A minor operational error that requires only internal documentation.
3. A security incident requiring only IT remediation with no regulatory reporting obligations.
4. A breach requiring notification only if the data is subsequently misused.

Question 10

1. A Data Protection Impact Assessment (DPIA) must be completed before the processing begins. (correct answer)
2. The company must register the system with its national tax authority.
3. All data subjects must be individually notified before the system goes live.
4. The system must use only on-premises infrastructure with no cloud components.

Question 11

1. Data must be stored in encrypted format at all times.
2. Personal data must be stored in the country where the data subject resides.
3. Personal data should be kept in a form that identifies individuals for no longer than necessary for the specified purpose. (correct answer)
4. Storage systems must be audited annually by an independent third party.

Question 12

1. Organizations must verify the accuracy of all personal data before processing it.
2. Data subjects must be informed of all parties with whom their data is shared.
3. Organizations must obtain separate consent for each category of personal data they process.
4. Personal data must be processed in a manner that ensures appropriate security, including protection against unauthorized access, loss, or destruction. (correct answer)

Question 13

1. Standard Contractual Clauses (SCCs) approved by the European Commission. (correct answer)
2. A mutual nondisclosure agreement between the company and the cloud provider.
3. The company's internal data governance policy stating that transfers are secure.
4. An annual privacy audit conducted by the cloud provider.

Question 14

1. The right to require organizations to delete all data about them within 24 hours of a request.
2. The right to receive compensation for any collection of their personal data.
3. The right to know what personal information is collected, the right to delete it, and the right to opt out of its sale. (correct answer)
4. The right to prevent organizations from collecting any data without prior written consent.

Question 15

1. Only a standard privacy notice informing employees of the collection.
2. A specific lawful basis under Article 9 for special category data, such as explicit consent or necessity for employment law obligations. (correct answer)
3. Approval from the national data protection authority before any processing begins.
4. Anonymization of all biometric templates within 30 days of collection.

Question 16

1. All organizations that collect any personally identifiable information from individuals.
2. Organizations with annual revenue exceeding $10 million that handle patient data.
3. State and local government health departments only.
4. Covered entities such as healthcare providers, health plans, and healthcare clearinghouses, and their business associates. (correct answer)

Question 17

1. An individual's email address and phone number.
2. An individual's health information, biometric data, or racial/ethnic origin. (correct answer)
3. An individual's employer name and job title.
4. An individual's shipping address and purchase history.

Question 18

1. The right to erasure, which requires organizations to delete data upon request.
2. The data breach notification requirement.
3. The requirement to appoint a Data Protection Officer.
4. The transparency and right to information requirements, which mandate clear disclosure of how personal data will be used and retained. (correct answer)

Question 19

1. A reactive approach where privacy controls are added to systems after they are deployed.
2. An approach in which privacy protections are embedded into the design and architecture of systems and processes from the outset. (correct answer)
3. A privacy audit methodology conducted annually to assess compliance.
4. A technical standard for encrypting personal data at rest and in transit.

Question 20

1. Require organizations to correct inaccurate personal data about them.
2. Access all personal data an organization holds about them.
3. Restrict the processing of their personal data while a complaint is being investigated.
4. Request deletion of their personal data when it is no longer necessary, consent is withdrawn, or other specified conditions are met. (correct answer)