CDPSE Cross-Border Data Transfers

Question 1

Under GDPR, which mechanism allows a US company to legally receive personal data from the EU without an adequacy decision?

Accepted Answer

Standard Contractual Clauses (SCCs)

Answer

Standard Contractual Clauses are EU-approved contractual templates that provide a valid transfer mechanism after Privacy Shield was invalidated by Schrems II.

Question 2

What is the primary purpose of an adequacy decision issued by the European Commission?

Accepted Answer

To recognize that a third country provides a comparable level of data protection to the EU

Answer

An adequacy decision means the EU has determined that a non-EU country's laws offer protection equivalent to EU standards, permitting free data flows to that country.

Question 3

Binding Corporate Rules (BCRs) are MOST appropriate for which scenario?

Accepted Answer

Intra-group data transfers among entities within a multinational corporation

Answer

BCRs are approved internal data protection policies that allow multinational groups to transfer personal data among their own affiliated entities across borders.

Question 4

Which US framework was created to facilitate commercial data transfers with the EU following Schrems II?

Accepted Answer

EU-US Data Privacy Framework

Answer

The EU-US Data Privacy Framework (2023) replaced Privacy Shield as the mechanism enabling US organizations to receive EU personal data after self-certification.

Question 5

A CDPSE professional must conduct a Transfer Impact Assessment (TIA). What is the main purpose of this assessment?

Accepted Answer

To evaluate whether the legal protections in the destination country adequately protect transferred data

Answer

A TIA assesses whether the destination country's laws or practices could undermine the protections provided by the transfer mechanism, such as SCCs.

CDPSE - Certified Data Privacy Solutions Engineer Practice Test

CDPSE - Certified Data Privacy Solutions Engineer Practice Test

CDPSE Cross-Border Data Transfers