CCO Data Privacy and Information Security Compliance 1 — Questions and Answers
Question 1: What does GDPR stand for and which organizations must comply with it?
- General Data Reporting Regulation; applies only to EU companies
- General Data Protection Regulation; applies to any organization processing personal data of EU residents (Correct answer)
- Global Data Privacy Rules; applies to US multinational companies only
- Government Data Protection Regulation; applies to public sector entities
Correct answer: General Data Protection Regulation; applies to any organization processing personal data of EU residents
GDPR is the EU's comprehensive data protection law that applies to any organization, regardless of location, that processes personal data of EU residents.
Question 2: What is 'personal data' under GDPR?
- Only social security numbers and financial records
- Any information relating to an identified or identifiable natural person (Correct answer)
- Business transaction records
- Anonymized statistical data
Correct answer: Any information relating to an identified or identifiable natural person
Personal data under GDPR includes any information that can directly or indirectly identify a natural person, including names, email addresses, location data, and online identifiers.
Question 3: What is the maximum fine for a serious GDPR violation?
- $1 million
- €20 million or 4% of global annual turnover, whichever is higher (Correct answer)
- €1 million or 1% of turnover
- There is no fine for first-time violations
Correct answer: €20 million or 4% of global annual turnover, whichever is higher
GDPR's highest tier of fines reaches €20 million or 4% of total worldwide annual revenue, whichever is greater.
Question 4: What is the California Consumer Privacy Act (CCPA)?
- A federal US data privacy law
- California's state privacy law granting consumers rights over their personal data collected by businesses (Correct answer)
- A regulation governing data centers only
- A credit reporting act specific to California
Correct answer: California's state privacy law granting consumers rights over their personal data collected by businesses
The CCPA gives California consumers the right to know, delete, and opt out of the sale of their personal information held by qualifying businesses.
Question 5: What is a Data Protection Impact Assessment (DPIA)?
- An annual IT security audit
- A structured process to identify and minimize data protection risks in high-risk processing activities (Correct answer)
- A customer survey on data handling preferences
- A financial assessment of data storage costs
Correct answer: A structured process to identify and minimize data protection risks in high-risk processing activities
DPIAs are required under GDPR for processing activities that pose high risks to individuals' rights, helping organizations identify and mitigate those risks before implementation.
Question 6: What is the GDPR requirement for reporting a personal data breach to supervisory authorities?
- Within 7 days of discovery
- Within 72 hours of becoming aware of the breach, unless it is unlikely to result in risk to individuals (Correct answer)
- Within 30 days of discovery
- Only if more than 1,000 individuals are affected
Correct answer: Within 72 hours of becoming aware of the breach, unless it is unlikely to result in risk to individuals
GDPR requires notifying the relevant supervisory authority within 72 hours of discovering a personal data breach, unless the breach is low-risk.
CCO Data Privacy and Information Security Compliance 1
What does GDPR stand for and which organizations must comply with it?