CCM Data Privacy and Information Security Compliance

Question 1

Under the EU General Data Protection Regulation (GDPR), a data breach that is likely to result in high risk to individuals' rights must be reported to:

Accepted Answer

The supervisory authority within 72 hours and to affected individuals without undue delay

Answer

GDPR Article 33 requires notification to the relevant supervisory authority within 72 hours of becoming aware of a breach (when feasible). Article 34 additionally requires notifying affected individuals 'without undue delay' when the breach is likely to result in high risk to their rights and freedoms.

Question 2

A company collects customer email addresses for a newsletter. Under a privacy-by-design framework, which approach best reflects this principle?

Accepted Answer

Build data minimization and consent mechanisms into the system before launch, not as an afterthought

Answer

Privacy by design requires embedding privacy protections into systems and processes from the start — not retrofitting them. This includes data minimization (collecting only what's needed), purpose limitation, and building consent mechanisms proactively. Retroactive encryption or annual purges do not satisfy the proactive standard.

Question 3

Under HIPAA, a 'business associate' is best defined as:

Accepted Answer

A person or entity that performs functions involving the use or disclosure of PHI on behalf of a covered entity

Answer

Under HIPAA, a business associate is a third-party vendor or contractor (not a workforce member) who creates, receives, maintains, or transmits PHI while performing services for a covered entity. Business associates must sign a Business Associate Agreement (BAA) and are directly subject to HIPAA's Security Rule.

Question 4

The California Consumer Privacy Act (CCPA) grants California residents the right to:

Accepted Answer

Know what personal information is collected about them and opt out of its sale

Answer

CCPA grants California residents the right to know what personal information a business collects, the right to delete that information (with exceptions), and the right to opt out of the sale of their personal information. It does not prohibit collection outright or require court approval for data collection.

Question 5

A compliance manager is building a data inventory as part of a privacy compliance program. What is the primary compliance purpose of maintaining such an inventory?

Accepted Answer

To identify what personal data is collected, where it is stored, how it is used, and who has access — enabling compliance with subject access and deletion requests

Answer

A data inventory (or data map) is foundational to privacy compliance. It enables organizations to respond to data subject rights requests (access, deletion, portability), demonstrate lawful bases for processing under GDPR, manage data retention, and identify risks. Without it, organizations cannot reliably comply with modern privacy laws.

(CCM) Certified Compliance Manager Practice Test

(CCM) Certified Compliance Manager Practice Test

CCM Data Privacy and Information Security Compliance