CRM Information Security & Privacy 3

Question 1

Under the GDPR, a data subject's 'right to erasure' is also known as the:

Accepted Answer

Right to be forgotten

Answer

The GDPR's right to erasure (Article 17) is commonly called the 'right to be forgotten,' allowing individuals to request deletion of their personal data.

Question 2

Which records management practice BEST supports compliance with breach notification laws?

Accepted Answer

Maintaining an accurate inventory of where personal data is stored

Answer

Knowing where personal data resides enables organizations to quickly identify affected records and comply with breach notification timelines.

Question 3

An organization uses 'tokenization' for protecting credit card numbers in records. What does tokenization do?

Accepted Answer

Replaces sensitive data with a non-sensitive surrogate value

Answer

Tokenization substitutes sensitive data with a placeholder token, so the original value is never stored in operational systems.

Question 4

Which federal law primarily governs privacy of student education records in the United States?

Accepted Answer

FERPA

Answer

FERPA (Family Educational Rights and Privacy Act) protects the privacy of student education records at institutions receiving federal funding.

Question 5

A records manager is developing a security policy for email records containing PII. The FIRST step should be to:

Accepted Answer

Identify and classify the PII contained in email records

Answer

Before applying controls, the manager must identify and classify what PII exists in email records to determine the appropriate protection level.

(CRM) Certified Records Manager Practice Test

(CRM) Certified Records Manager Practice Test

CRM Information Security & Privacy 3