Data Governance & Compliance Flashcards

Which US law requires financial institutions to explain their information-sharing practices and safeguard customers' sensitive data?

Answer: Gramm-Leach-Bliley Act (GLBA)

GLBA's Privacy Rule and Safeguards Rule govern financial institutions' handling of customer information.

COPPA primarily regulates the online collection of personal information from which group?

Answer: Children under 13

COPPA requires verifiable parental consent before collecting personal data from children under 13.

A CDO wants to ensure deleted customer data is also removed from backups and downstream copies. Which governance control addresses this?

Answer: Records retention and disposition policy with defined deletion procedures across all copies

Retention and disposition policies define how and when data must be destroyed everywhere it resides.

Which of the following is the BEST description of a data custodian?

Answer: The person or team responsible for technical storage, security, and maintenance of data per owner requirements

Custodians manage the technical environment and controls according to the data owner's rules.

What is a key reason to perform a Data Protection Impact Assessment (DPIA) before launching a new analytics initiative?

Answer: To identify and mitigate privacy risks for processing likely to result in high risk to individuals

A DPIA assesses and mitigates privacy risks before high-risk processing begins.

Which approach best embeds governance into a modern data mesh architecture?

Answer: Federated computational governance with automated policies applied across domain data products

Data mesh relies on federated computational governance to automate global policies across domains.

Executive sponsorship of data governance is critical primarily because it:

Answer: Provides authority, funding, and cross-functional alignment needed to enforce policies

Executive sponsors give governance the authority and resources to drive adoption across silos.