CTO Regulatory Compliance & Legal Flashcards

Under GDPR, which role is responsible for ensuring technology systems process personal data lawfully, and what is their primary obligation?

Answer: The Data Protection Officer (DPO), who oversees compliance and advises on data protection obligations

The DPO is the designated compliance role under GDPR responsible for monitoring data protection practices and serving as the point of contact for supervisory authorities.

A US-based healthcare technology company must ensure its platform complies with patient data privacy requirements. Which regulation is primarily applicable?

Answer: HIPAA (Health Insurance Portability and Accountability Act)

HIPAA sets the federal standard for protecting sensitive patient health information (PHI) in the United States, applying to covered entities and their business associates.

What is a Software Bill of Materials (SBOM) and why is it increasingly required by US regulators for technology vendors?

Answer: A formal inventory of software components and dependencies used in a product, required to identify supply chain vulnerabilities

An SBOM provides transparency into the open-source and third-party components within software, enabling organizations to quickly assess exposure when new vulnerabilities are disclosed.

The Sarbanes-Oxley Act (SOX) Section 404 has significant implications for CTOs of publicly traded US companies. What does it primarily require?

Answer: Management to assess and report on the effectiveness of internal controls over financial reporting, including IT controls

SOX Section 404 requires management to evaluate and attest to the effectiveness of internal controls over financial reporting, with IT general controls being a critical component.

A CTO is launching a product that collects personal data from California residents. Which state privacy law must the product comply with?

Answer: California Consumer Privacy Act (CCPA) / California Privacy Rights Act (CPRA)

The CCPA (amended by CPRA) grants California residents rights over their personal data and imposes obligations on businesses that collect or sell that data.

What is the purpose of a Data Processing Agreement (DPA) between a technology company and its cloud provider?

Answer: To define the legal obligations of the processor when handling personal data on behalf of the controller

A DPA is a legally required contract under GDPR and similar laws that specifies how a processor must handle personal data on behalf of the controller, including security measures and data subject rights.