CDS Regulatory Compliance & Data Privacy 3

Question 1

When a GDPR Data Protection Impact Assessment (DPIA) identifies a high residual risk that cannot be mitigated, what must the data controller do?

Accepted Answer

Consult with the supervisory authority before processing

Answer

GDPR Article 36 requires prior consultation with the competent supervisory authority when a DPIA shows high residual risk that the controller cannot mitigate.

Question 2

Under CCPA/CPRA, what is the maximum civil penalty per intentional violation?

Accepted Answer

$7,500

Answer

CCPA/CPRA allows civil penalties of up to $2,500 per unintentional violation and up to $7,500 per intentional violation.

Question 3

A hospital shares de-identified patient data with a research university. Under HIPAA, which method allows sharing data with NO residual risk threshold requirement?

Accepted Answer

Safe Harbor method

Answer

The Safe Harbor method requires removal of 18 specific identifiers and provides a defined standard, while Expert Determination requires a statistical expert to certify very small re-identification risk.

Question 4

Which GDPR principle requires that personal data be kept in a form that permits identification of data subjects for no longer than necessary?

Accepted Answer

Storage limitation

Answer

The storage limitation principle (Article 5(1)(e)) requires data to be deleted or anonymized once the purpose for which it was collected has been fulfilled.

Question 5

SOX Section 404 places primary responsibility for assessing and reporting on internal controls over financial reporting on:

Accepted Answer

The company's management

Answer

SOX Section 404(a) requires management to assess and report on the effectiveness of internal controls over financial reporting, with external auditors attesting to that assessment.

(CDS) Certified Data Steward Practice Test

(CDS) Certified Data Steward Practice Test

CDS Regulatory Compliance & Data Privacy 3