CTO Regulatory Compliance & Legal Flashcards

What is a 'right to be forgotten' request, and what technical capability must a CTO ensure exists to comply with it?

Answer: A data subject's right to request deletion of their personal data, requiring systems to locate and erase all instances of that data

Under GDPR Article 17, individuals can request erasure of their personal data, requiring organizations to have technical processes to identify and delete that data across all systems and backups.

Which open-source license type requires that any derivative work also be released under the same open-source license, creating a 'copyleft' obligation?

Answer: GPL (GNU General Public License)

The GPL is a copyleft license that requires any software incorporating GPL-licensed code to also be released under the GPL, which can affect commercial software strategies.

A SaaS company stores customer data in multiple US states and the EU. What is the primary legal challenge this creates for data governance?

Answer: Compliance with multiple and sometimes conflicting data residency, privacy, and transfer laws across jurisdictions

Different jurisdictions have different requirements for where data can be stored, how it can be transferred, and how it must be protected, requiring a multi-jurisdictional compliance strategy.

What is a Business Associate Agreement (BAA) and when is a CTO required to execute one?

Answer: A HIPAA-required contract with vendors who access, process, or store protected health information on behalf of a covered entity

A BAA is a HIPAA-mandated contract that requires business associates (vendors handling PHI) to implement appropriate safeguards and limits on how they use or disclose that information.

The EU AI Act classifies AI systems into risk categories. Which category requires the most stringent compliance obligations for CTOs deploying AI in high-stakes decisions?

Answer: High-risk AI systems, which require conformity assessments, transparency, and human oversight before deployment

High-risk AI systems under the EU AI Act (e.g., those used in hiring, credit, healthcare, or law enforcement) require extensive documentation, testing, human oversight, and conformity assessments.

What is the primary purpose of a data retention policy from a legal and compliance perspective?

Answer: To define how long different categories of data must be kept and when they must be securely deleted, ensuring legal compliance and minimizing liability

Data retention policies ensure organizations keep data for legally required periods (e.g., financial records for 7 years) while deleting data when it is no longer needed, reducing legal discovery exposure.