Data Privacy and Information Security Compliance Flashcards
6 cards from real CCM practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 6 Data Privacy and Information Security Compliance flashcards as text
Under the EU General Data Protection Regulation (GDPR), a data breach that is likely to result in high risk to individuals' rights must be reported to:
Answer: The supervisory authority within 72 hours and to affected individuals without undue delay
GDPR Article 33 requires notification to the relevant supervisory authority within 72 hours of becoming aware of a breach (when feasible). Article 34 additionally requires notifying affected individuals 'without undue delay' when the breach is likely to result in high risk to their rights and freedoms.
A company collects customer email addresses for a newsletter. Under a privacy-by-design framework, which approach best reflects this principle?
Answer: Build data minimization and consent mechanisms into the system before launch, not as an afterthought
Privacy by design requires embedding privacy protections into systems and processes from the start — not retrofitting them. This includes data minimization (collecting only what's needed), purpose limitation, and building consent mechanisms proactively. Retroactive encryption or annual purges do not satisfy the proactive standard.
Under HIPAA, a 'business associate' is best defined as:
Answer: A person or entity that performs functions involving the use or disclosure of PHI on behalf of a covered entity
Under HIPAA, a business associate is a third-party vendor or contractor (not a workforce member) who creates, receives, maintains, or transmits PHI while performing services for a covered entity. Business associates must sign a Business Associate Agreement (BAA) and are directly subject to HIPAA's Security Rule.
The California Consumer Privacy Act (CCPA) grants California residents the right to:
Answer: Know what personal information is collected about them and opt out of its sale
CCPA grants California residents the right to know what personal information a business collects, the right to delete that information (with exceptions), and the right to opt out of the sale of their personal information. It does not prohibit collection outright or require court approval for data collection.
A compliance manager is building a data inventory as part of a privacy compliance program. What is the primary compliance purpose of maintaining such an inventory?
Answer: To identify what personal data is collected, where it is stored, how it is used, and who has access — enabling compliance with subject access and deletion requests
A data inventory (or data map) is foundational to privacy compliance. It enables organizations to respond to data subject rights requests (access, deletion, portability), demonstrate lawful bases for processing under GDPR, manage data retention, and identify risks. Without it, organizations cannot reliably comply with modern privacy laws.
Which of the following is an example of a 'legitimate interest' as a lawful basis for processing personal data under GDPR?
Answer: Processing employee contact details for payroll and benefits administration
Processing employee data for payroll and HR administration is a recognized legitimate interest (and often necessary for contract performance) under GDPR. Selling data to advertisers, covert tracking for ad profiling, and sharing medical records without consent are not legitimate interests and likely require explicit consent or other lawful bases.