Subject Rights Flashcards
7 cards from real CDPSE practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Subject Rights flashcards as text
Under GDPR, what is the standard timeframe for a controller to respond to a data subject access request?
Answer: One month
GDPR Article 12 requires controllers to respond to data subject requests without undue delay and at most within one month of receiving the request.
Which of the following is an example of 'pseudonymization' that still retains subject rights applicability?
Answer: Replacing names with codes where the mapping key is retained separately
Pseudonymization replaces identifying information with a code, but because the key exists to re-identify, the data remains personal data and subject rights still apply.
An employee asks their employer to delete all personal data collected about them. Under GDPR, which exemption most likely allows the employer to retain employment records?
Answer: Legal obligation to maintain employment and payroll records under national law
Employment records are typically subject to statutory retention requirements, qualifying as a legal obligation that overrides the erasure right under GDPR Article 17(3)(b).
The Colorado Privacy Act (CPA) grants consumers a right to appeal. What does this right entail?
Answer: The right to appeal a controller's refusal to act on a rights request within a specified period
The Colorado Privacy Act requires controllers to establish an appeals process allowing consumers to challenge a controller's refusal to honor a privacy rights request.
A data subject requests their personal data be ported to a new service provider. The controller argues the data is too voluminous to transfer. Is this a valid reason to refuse portability under GDPR?
Answer: No, volume alone is not a valid exemption; the controller must provide the data
GDPR does not recognize data volume as an exemption for portability; controllers must provide the data unless a specific legal exception applies.
Under the CCPA, what does the 'right to know' allow a consumer to request?
Answer: Categories and specific pieces of personal information collected, sources, business purpose, and third parties it was shared with
The CCPA right to know covers categories and specific pieces of personal information, sources, business or commercial purposes, and categories of third parties the data was shared with.
Which GDPR principle directly underpins subject rights by requiring data to be accurate and kept up to date?
Answer: Accuracy
The accuracy principle (Article 5(1)(d)) requires that personal data be accurate and, where necessary, kept up to date, directly supporting the right to rectification.