CCM Data Privacy and Information Security Compliance

Question 1

Under the EU General Data Protection Regulation (GDPR), a data breach that is likely to result in high risk to individuals' rights must be reported to:

Accepted Answer

The supervisory authority within 72 hours and to affected individuals without undue delay

Answer

Only the affected individuals within 30 days of discovery

Answer

The European Commission within 24 hours of discovery

Answer

The data processor within 48 hours, who then notifies the supervisory authority

Question 2

A company collects customer email addresses for a newsletter. Under a privacy-by-design framework, which approach best reflects this principle?

Accepted Answer

Build data minimization and consent mechanisms into the system before launch, not as an afterthought

Answer

Collect all available customer data and delete it annually during a scheduled purge

Answer

Encrypt customer data only when a breach has been detected

Answer

Obtain consent once at signup, then assume it covers all future data uses

Question 3

Under HIPAA, a 'business associate' is best defined as:

Accepted Answer

A person or entity that performs functions involving the use or disclosure of PHI on behalf of a covered entity

Answer

Any employee of a covered entity who handles protected health information

Answer

A government agency that regulates the covered entity's health plan

Answer

A patient who has authorized release of their medical records to a third party

Question 4

The California Consumer Privacy Act (CCPA) grants California residents the right to:

Accepted Answer

Know what personal information is collected about them and opt out of its sale

Answer

Demand that a company never collect their data under any circumstances

Answer

Sue companies for any data collection without prior court approval

Answer

Access only the data collected in the past 30 days

Question 5

A compliance manager is building a data inventory as part of a privacy compliance program. What is the primary compliance purpose of maintaining such an inventory?

Accepted Answer

To identify what personal data is collected, where it is stored, how it is used, and who has access — enabling compliance with subject access and deletion requests

Answer

To calculate the company's total data storage costs for the IT budget

Answer

To satisfy SEC disclosure requirements for publicly traded companies

Answer

To provide a list of all employees who have accessed the HR database

Question 6

Which of the following is an example of a 'legitimate interest' as a lawful basis for processing personal data under GDPR?

Accepted Answer

Processing employee contact details for payroll and benefits administration

Answer

Selling customer email addresses to third-party advertisers to generate revenue

Answer

Collecting browsing history from website visitors without their knowledge to build advertising profiles

Answer

Sharing customer medical records with marketing partners without consent