CIPM Data Subject Rights Flashcards

Under GDPR Article 17, which of the following would allow a data controller to REFUSE an erasure request?

Answer: The data is needed for exercising the right of legal defense

Under GDPR Article 17, data controllers may refuse erasure requests when the data is necessary for establishing, exercising, or defending legal claims.

What is the primary purpose of a Data Subject Access Request (DSAR)?

Answer: To allow individuals to obtain a copy of their personal data

A DSAR enables individuals to obtain a copy of their personal data held by an organization and learn how it is being processed.

Under GDPR, when may organizations charge a fee for responding to a data subject access request?

Answer: Only for requests that are manifestly unfounded or excessive

GDPR allows organizations to charge a reasonable fee or refuse to act on requests that are manifestly unfounded or excessive, particularly repetitive ones.

Which GDPR right enables data subjects to challenge decisions made solely by automated processing that significantly affects them?

Answer: Right not to be subject to automated decision-making

GDPR Article 22 provides data subjects the right to not be subject to solely automated decisions that significantly affect them, including profiling.

Which of the following must be provided when responding to a data subject access request?

Answer: The purposes of processing and categories of recipients

DSARs must be fulfilled with information including the purposes of processing, categories of data held, and recipients or categories of recipients.

Under CCPA, what does the 'right to know' allow consumers to request from a business?

Answer: Categories and specific pieces of personal information collected about them

The CCPA right to know allows consumers to request disclosure of the categories and specific pieces of personal information a business has collected about them.