Practice Test GeeksCDO - Chief Data Officer Certification Practice Test
← All CDO Flashcard Decks

Regulatory Policy & Ethical Standards Flashcards

7 cards from real CDO practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.

Read the first 7 Regulatory Policy & Ethical Standards flashcards as text

  1. Under GDPR, within what timeframe must a controller notify the supervisory authority of a personal data breach likely to pose a risk to individuals?

    Answer: 72 hours after becoming aware

    GDPR Article 33 requires notification without undue delay and, where feasible, within 72 hours of becoming aware of the breach.

  2. A CDO wants to use customer purchase data, originally collected for order fulfillment, to train a marketing propensity model. Which GDPR principle is most directly implicated?

    Answer: Purpose limitation

    Purpose limitation requires that data collected for specified purposes not be further processed in a manner incompatible with those purposes.

  3. Under the HIPAA Privacy Rule, which method of de-identification requires removal of 18 specified identifiers?

    Answer: Safe Harbor

    The Safe Harbor method requires removing 18 listed identifiers and having no actual knowledge that the remaining data could identify an individual.

  4. Which U.S. federal law requires financial institutions to explain their information-sharing practices and safeguard sensitive customer data?

    Answer: Gramm-Leach-Bliley Act

    GLBA's Financial Privacy Rule and Safeguards Rule govern privacy notices and data protection for financial institutions.

  5. GDPR Article 22 gives data subjects the right not to be subject to which type of decision?

    Answer: Decisions based solely on automated processing that produce legal or similarly significant effects

    Article 22 restricts solely automated decision-making, including profiling, with legal or similarly significant effects.

  6. Which document is a CDO most likely to require before launching a high-risk processing activity such as large-scale profiling under GDPR?

    Answer: Data Protection Impact Assessment

    GDPR Article 35 mandates a DPIA when processing is likely to result in a high risk to individuals' rights and freedoms.

  7. Which data ethics practice best addresses the risk that a hiring algorithm disadvantages a protected group?

    Answer: Conducting regular bias and disparate impact testing

    Bias and disparate impact testing directly measures whether outcomes differ unfairly across protected groups.

How this page was made: written with AI tools and published by Nathan Beja, founder of Practice Test Geeks, who is responsible for its content. We have not yet matched this exam's facts to an official source, so confirm fees, dates and rules with the exam body. Not reviewed by a subject-matter expert. Editorial policy