CCO Data Privacy and Information Security Compliance 3

Question 1

What is a data processing agreement (DPA) and when is it required?

Accepted Answer

A legally required agreement between a data controller and a data processor outlining how personal data will be handled

Answer

A contract between a data subject and a company

Answer

An internal IT security policy

Answer

A software licensing agreement

Question 2

What does 'pseudonymization' mean in data privacy?

Accepted Answer

Replacing directly identifying information with artificial identifiers so data cannot be attributed to a specific person without additional information

Answer

Permanently deleting personal data

Answer

Encrypting all data at rest

Answer

Sharing data in aggregate form only

Question 3

What is the purpose of a Records of Processing Activities (RoPA) under GDPR?

Accepted Answer

To document all processing activities involving personal data, required for organizations with 250 or more employees or high-risk processing

Answer

To log employee access to data systems

Answer

To maintain customer service interaction logs

Answer

To satisfy financial reporting requirements

Question 4

What is the significance of cross-border data transfer restrictions under GDPR?

Accepted Answer

They restrict transferring personal data to countries outside the EEA that do not have adequate data protection levels

Answer

They prevent all international business communications

Answer

They apply only to financial data

Answer

They prohibit cloud storage in non-EU countries entirely

Question 5

What is a security incident response plan in the context of data privacy compliance?

Accepted Answer

A documented process for detecting, containing, assessing, notifying, and recovering from data security incidents

Answer

A marketing communication plan for after a breach

Answer

An IT disaster recovery plan for hardware failures

Answer

A plan for responding to negative media coverage

Question 6

What is 'consent' as a lawful basis under GDPR?

Accepted Answer

Freely given, specific, informed, and unambiguous indication of the data subject's agreement to processing their personal data

Answer

Any agreement to terms of service

Answer

Implied agreement through continued use of a service

Answer

A company's internal approval for data use