Data Governance & Compliance Flashcards

Under the GDPR, within what time frame must a controller notify the supervisory authority of a personal data breach, where feasible?

Answer: 72 hours

GDPR Article 33 requires notification without undue delay and, where feasible, within 72 hours of awareness.

A US company with EU customers transfers personal data to its US data center. Which mechanism can legitimize this transfer for a certified organization?

Answer: EU-U.S. Data Privacy Framework

The EU-U.S. Data Privacy Framework, adopted in 2023, replaced the invalidated Privacy Shield for certified US organizations.

Which SOX section requires management to assess and report on internal controls over financial reporting, impacting financial data governance?

Answer: Section 404

SOX Section 404 requires management assessment and auditor attestation of internal controls over financial reporting.

A data steward discovers sensitive data in an unclassified dataset shared broadly across the company. What should happen first?

Answer: Classify the data, restrict access per policy, and escalate per the incident process

Classification and access restriction contain risk while the governance and incident process determines next steps.

What does the principle of 'data minimization' require?

Answer: Collecting and retaining only personal data that is adequate, relevant, and necessary for the stated purpose

Data minimization limits personal data to what is necessary for the specified purpose.

Which framework is most widely referenced as a comprehensive body of knowledge for data management, including governance as its central function?

Answer: DAMA-DMBOK

DAMA-DMBOK places data governance at the center of its data management knowledge areas.

An organization must prove where a regulatory report's figures originated and how they were transformed. Which capability is most essential?

Answer: End-to-end data lineage

Data lineage traces data from source through transformations to the report, supporting auditability.