Certified Information Privacy Professional CCPA and CPRA Compliance 2

Question 1

What is the CPRA's data retention principle that businesses must follow?

Accepted Answer

Retain personal information only as long as reasonably necessary for the disclosed purpose

Answer

Retain data indefinitely unless the consumer requests deletion

Answer

Retain data for a minimum of 7 years

Answer

Retain data only for 30 days

Question 2

Under the CCPA, which category is considered 'sensitive personal information' that triggers additional obligations under CPRA?

Accepted Answer

Social Security numbers and precise geolocation data

Answer

General browsing history

Answer

IP addresses without device linking

Answer

Business email addresses

Question 3

What right allows California consumers to correct inaccurate personal information held by a business?

Accepted Answer

Right to Correct (added by CPRA)

Answer

Right to Erasure

Answer

Right to Access

Answer

Right to Portability

Question 4

The CCPA's private right of action is limited to which type of data breach?

Accepted Answer

Breaches of non-encrypted or non-redacted personal information due to failure to maintain reasonable security

Answer

Any unauthorized disclosure of personal information

Answer

Breaches involving only sensitive personal information

Answer

Breaches where the FTC has already taken action

Question 5

Which business practice allows a company to offer financial incentives for consumers to share their personal information under CCPA?

Accepted Answer

Financial incentive programs with required notice and opt-in

Answer

Automatic enrollment in data sharing for discounts

Answer

Mandatory data sharing as a condition of service

Answer

Silent data collection without disclosure

Question 6

Under the CPRA, what is a 'contractor' as distinct from a 'service provider'?

Accepted Answer

An entity that receives personal information pursuant to a written contract but not in the context of providing services to the business

Answer

An employee of the business who handles data

Answer

A government entity receiving data under a legal process

Answer

A marketing partner that buys data