CRM Regulatory Compliance 3 — Questions and Answers
Question 1: What is the primary purpose of a records retention schedule in the context of regulatory compliance?
- To maximize storage space utilization
- To ensure records are kept for legally required periods and then destroyed (Correct answer)
- To catalog all records for easy retrieval
- To assign ownership of records to departments
Correct answer: To ensure records are kept for legally required periods and then destroyed
A retention schedule documents how long each record series must be kept to satisfy legal, regulatory, and operational requirements before authorized disposition.
Question 2: The EU General Data Protection Regulation (GDPR) concept of 'data minimization' requires organizations to:
- Encrypt all personal data
- Collect only data adequate and relevant to the specified purpose (Correct answer)
- Store data in the EU only
- Delete data after 30 days
Correct answer: Collect only data adequate and relevant to the specified purpose
GDPR Article 5(1)(c) mandates that personal data be adequate, relevant, and limited to what is necessary for the processing purpose.
Question 3: Under the Americans with Disabilities Act (ADA), how long must employers retain applications and other personnel records?
- 6 months
- 1 year (Correct answer)
- 3 years
- 7 years
Correct answer: 1 year
EEOC regulations under the ADA require employers to retain personnel and employment records for a minimum of one year from the date of the record or the personnel action, whichever is later.
Question 4: Which concept describes the chain of custody and trackable history of a record from creation to final disposition?
- Provenance
- Audit trail (Correct answer)
- Life cycle management
- Disposition authority
Correct answer: Audit trail
An audit trail documents every action taken on a record, establishing accountability and supporting legal admissibility.
Question 5: The California Consumer Privacy Act (CCPA) grants consumers the right to:
- Have their data encrypted at all times
- Know what personal information is collected and request its deletion (Correct answer)
- Restrict data to California servers only
- Receive monetary compensation for data use
Correct answer: Know what personal information is collected and request its deletion
CCPA grants California residents the right to know, delete, opt-out, and non-discrimination regarding their personal information.
Question 6: A government agency must respond to a FOIA request within how many business days (standard response time)?
- 10 business days
- 20 business days (Correct answer)
- 30 business days
- 60 business days
Correct answer: 20 business days
FOIA requires federal agencies to respond to requests within 20 business days, though complex requests may qualify for extensions.
Question 7: Which IRS regulation governs the retention of tax records for corporations?
- IRC Section 6001 (Correct answer)
- SOX Section 302
- FRCP Rule 37
- CFR Title 26
Correct answer: IRC Section 6001
IRC Section 6001 requires every person liable for any tax to keep records sufficient to establish their tax liability.
CRM Regulatory Compliance 3
What is the primary purpose of a records retention schedule in the context of regulatory compliance?