CyberVista Data Security and Privacy Flashcards
7 cards from real CyberVista Test practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 CyberVista Data Security and Privacy flashcards as text
Under GDPR, organizations are required to report a personal data breach to the supervisory authority within:
Answer: 72 hours of discovery
GDPR Article 33 requires that a personal data breach likely to result in risk to individuals must be reported to the relevant supervisory authority within 72 hours of becoming aware of it.
The California Consumer Privacy Act (CCPA) grants California residents the right to:
Answer: Know what personal information is collected and request its deletion
CCPA gives California residents the right to know what personal data is being collected, the right to delete it, the right to opt out of its sale, and the right to non-discrimination for exercising these rights.
Which of the following is considered Protected Health Information (PHI) under HIPAA?
Answer: A patient's name combined with their medical diagnosis
PHI is individually identifiable health information that includes any combination of an identifier (such as a name) and health-related data (such as a diagnosis or treatment).
Privacy by Design (PbD) is a framework that requires privacy to be:
Answer: Embedded into system design from the outset rather than retrofitted
Privacy by Design mandates that privacy protections be proactively built into technology and business processes from the earliest design stage, not added as an afterthought.
The 'Right to be Forgotten' (Right to Erasure) under GDPR allows individuals to:
Answer: Request deletion of their personal data under certain conditions
GDPR Article 17 gives individuals the right to request erasure of their personal data when it is no longer necessary, consent is withdrawn, or the data was unlawfully processed.
Which role under GDPR is responsible for ensuring that an organization's data processing activities comply with the regulation?
Answer: Data Protection Officer (DPO)
The Data Protection Officer (DPO) is a role mandated by GDPR for certain organizations, responsible for overseeing data protection strategy and ensuring compliance with the regulation.
An organization collects customer email addresses only for order confirmations but later uses them for marketing campaigns without re-obtaining consent. This violates which privacy principle?
Answer: Purpose limitation
The purpose limitation principle requires that personal data be collected for specified, explicit, and legitimate purposes and not further processed in a manner incompatible with those purposes.