GDPR Architecture & System Design 3

Question 1

In a cloud-native architecture, which mechanism BEST supports GDPR data residency requirements when deploying across multiple regions?

Accepted Answer

Geo-fencing with data sovereignty controls that restrict replication to approved regions

Answer

Geo-fencing with data sovereignty controls ensures personal data of EU residents remains within approved jurisdictions, supporting GDPR's data transfer restrictions.

Question 2

Which architectural pattern for handling data subject access requests (DSARs) is most scalable for large enterprise systems with dozens of data stores?

Accepted Answer

A data discovery and metadata catalog integrated with automated DSAR orchestration

Answer

A metadata catalog combined with automated orchestration enables systematic, auditable, and timely responses to DSARs across many data stores.

Question 3

When designing audit logging for GDPR compliance, which characteristic is MOST important for the logs themselves?

Accepted Answer

Logs must be tamper-evident, access-controlled, and retained for an appropriate period

Answer

Audit logs must be tamper-evident to serve as trustworthy accountability records, access-controlled to prevent unauthorized modification, and retained to support breach investigation and regulatory inquiries.

Question 4

A system architect proposes using a blockchain to store personal data to ensure immutability. Why is this problematic under GDPR?

Accepted Answer

Immutability conflicts with the right to erasure and right to rectification

Answer

Blockchain's core property of immutability directly conflicts with GDPR Articles 17 and 16, which grant individuals the right to erasure and correction of personal data.

Question 5

Which concept describes the architectural practice of giving each system component only the minimum access to personal data needed to perform its function?

Accepted Answer

Principle of least privilege

Answer

The principle of least privilege limits each component's access to only the personal data it genuinely needs, directly supporting GDPR data minimization and integrity requirements.

(GDPR) Certified General Data Protection Regulation Specialist Practice Test

(GDPR) Certified General Data Protection Regulation Specialist Practice Test

GDPR Architecture & System Design 3