CDPSE Subject Rights 4

Question 1

A US healthcare organization is subject to HIPAA. A patient requests a copy of their medical records. What is the maximum number of days the covered entity has to respond?

Accepted Answer

30 days

Answer

HIPAA requires covered entities to provide access to protected health information within 30 days of a request, with one 30-day extension permitted.

Question 2

Under GDPR, when does the right to data portability apply?

Accepted Answer

Only when processing is based on consent or a contract and carried out by automated means

Answer

The right to portability under GDPR Article 20 applies only when processing is based on consent or contract, and is carried out by automated means.

Question 3

An organization processes children's data. Under COPPA, what right do parents have regarding their child's personal information?

Accepted Answer

Right to review, delete, and refuse further collection of their child's data

Answer

COPPA grants parents the right to review, request deletion of, and refuse further collection or use of their child's personal information.

Question 4

Which of the following best describes a 'data subject' under GDPR?

Accepted Answer

An identified or identifiable natural person whose personal data is processed

Answer

A data subject is a living, identified or identifiable natural person to whom personal data relates.

Question 5

A data subject exercises their right to object to processing based on legitimate interests. What must the controller demonstrate to continue processing?

Accepted Answer

Compelling legitimate grounds that override the individual's interests, rights, and freedoms

Answer

Under GDPR Article 21, when a data subject objects to processing based on legitimate interests, the controller must show compelling grounds that override the subject's rights to continue.

CDPSE - Certified Data Privacy Solutions Engineer Practice Test

CDPSE - Certified Data Privacy Solutions Engineer Practice Test

CDPSE Subject Rights 4