Data Lifecycle Management and Governance Flashcards

What is the purpose of a data processing agreement (DPA) between a controller and a processor?

Answer: To contractually bind the processor to process data only on documented instructions and implement adequate safeguards

A DPA ensures the processor acts only on the controller's instructions, maintains confidentiality, and implements appropriate technical and organizational security measures.

A company maintains records of all its data processing activities including purposes, categories of data, and retention periods. What is this record called?

Answer: Record of Processing Activities (RoPA)

A Record of Processing Activities (RoPA) is a documented inventory of all processing activities required by privacy regulations such as GDPR Article 30.

Which concept describes tracking the origin, movement, and transformations of data across its entire lifecycle within an organization?

Answer: Data lineage

Data lineage documents where data comes from, how it moves through systems, and how it is transformed, enabling accountability and privacy compliance verification.

An organization must delete a customer's data upon request. Which governance process ensures all copies — including backups — are identified and removed?

Answer: Data mapping combined with a defined erasure workflow

Effective erasure requires a comprehensive data map to locate all copies — production, backup, archives, and third-party processors — followed by a documented deletion workflow.

What does 'data sovereignty' mean in the context of data governance?

Answer: Data is subject to the laws of the country in which it is collected or stored

Data sovereignty means that data is governed by the legal and regulatory framework of the jurisdiction where it resides, affecting cross-border transfer decisions.

Which governance mechanism ensures that personal data collected for one purpose is not used for an incompatible second purpose?

Answer: Purpose limitation controls

Purpose limitation controls — including technical restrictions and policy enforcement — prevent data from being repurposed beyond its original, consented-to use.