CDPSE Subject Rights 2

Question 1

Under the CCPA, a consumer's right to opt-out applies specifically to which activity?

Accepted Answer

Sale of personal information to third parties

Answer

The CCPA's right to opt-out targets the sale of personal information to third parties, not internal processing or contracted service providers.

Question 2

A data subject submits a right-of-access request but cannot verify their identity. What is the organization's best course of action?

Accepted Answer

Request additional identity verification information before fulfilling the request

Answer

Organizations should request additional verification before fulfilling access requests to prevent unauthorized disclosure of personal data.

Question 3

Which GDPR article establishes the right to erasure ('right to be forgotten')?

Accepted Answer

Article 17

Answer

GDPR Article 17 establishes the right to erasure, allowing data subjects to request deletion of their personal data under specific conditions.

Question 4

An organization receives a data portability request. In which format must the data be provided?

Accepted Answer

A structured, commonly used, machine-readable format

Answer

GDPR Article 20 requires that data provided for portability be in a structured, commonly used, machine-readable format such as CSV or JSON.

Question 5

Which condition allows an organization to REFUSE a right-to-erasure request under GDPR?

Accepted Answer

The data is necessary for compliance with a legal obligation

Answer

GDPR Article 17(3) permits refusal of erasure requests when retention is necessary to comply with a legal obligation.

CDPSE - Certified Data Privacy Solutions Engineer Practice Test