TypeScript Regulatory Compliance & Legal Framework 5

Question 1

A TypeScript SaaS application retains deleted user records for 2 years 'just in case'. Which GDPR principle does this most likely violate?

Accepted Answer

Storage Limitation

Answer

GDPR's storage limitation principle requires that personal data be kept no longer than necessary for the specified purpose; indefinite retention after account deletion requires a specific legal basis.

Question 2

Which TypeScript technique can help ensure audit log entries cannot be tampered with after they are written?

Accepted Answer

Appending a cryptographic hash or HMAC chaining each log entry to the previous one

Answer

HMAC-chaining or hash-linking log entries means any modification to a previous entry breaks the chain, making tampering detectable—a common requirement for compliance audit trails.

Question 3

Which license would be most appropriate for a TypeScript project that must guarantee users always receive source code, even when accessed as a web service (SaaS)?

Accepted Answer

GNU Affero General Public License (AGPL)

Answer

The AGPL closes the 'SaaS loophole' by requiring that source code be provided to users who interact with the software over a network, not just those who receive a binary.

Question 4

A TypeScript API inadvertently returns a field named `ssn` in its JSON response. Which approach best prevents this at the type level?

Accepted Answer

Use `Omit<User, 'ssn'>` as the return type of the API handler

Answer

Using `Omit<User, 'ssn'>` as the return type makes the TypeScript compiler enforce that the `ssn` field is absent, catching accidental inclusion at compile time.

Question 5

Under PCI DSS, which requirement most directly applies to a TypeScript application that logs API requests containing full credit card numbers?

Accepted Answer

Requirement 3: Protect stored account data (prohibits storing sensitive authentication data)

Answer

PCI DSS Requirement 3 explicitly prohibits storing sensitive authentication data (including full card numbers unmasked) after authorization, making log entries containing PANs a violation.

TypeScript Practice Test

TypeScript Practice Test

TypeScript Regulatory Compliance & Legal Framework 5