WordPress Regulatory Frameworks & Compliance 5 — Questions and Answers
Question 1: When a WordPress site suffers a data breach exposing EU residents' personal data, within how many hours must the data controller notify the relevant supervisory authority under GDPR?
- 24 hours
- 48 hours
- 72 hours (Correct answer)
- 7 days
Correct answer: 72 hours
GDPR Article 33 requires data controllers to notify the relevant supervisory authority of a personal data breach within 72 hours of becoming aware of it.
Question 2: Under GDPR, what is a 'legitimate interest' as a legal basis for processing personal data on a WordPress site?
- Any business reason the site owner finds profitable
- A genuine interest that is necessary and proportionate, not overridden by the individual's rights (Correct answer)
- Interest earned on financial investments related to data
- A legal requirement imposed by government regulation
Correct answer: A genuine interest that is necessary and proportionate, not overridden by the individual's rights
Legitimate interest requires a real and present business need that is proportionate and does not override the data subject's rights and freedoms.
Question 3: Which of the following is a requirement of the GDPR's 'Privacy by Design' principle when building a new WordPress plugin?
- Publishing the plugin's source code publicly
- Integrating data protection measures into the system architecture from the start (Correct answer)
- Using only free and open-source libraries
- Registering the plugin with a supervisory authority
Correct answer: Integrating data protection measures into the system architecture from the start
Privacy by Design requires that data protection be embedded into the design and architecture of systems and business practices from the outset, not added later.
Question 4: A WordPress e-commerce site targeting Canadian customers must comply with which Canadian privacy legislation regarding personal data collection?
- CASL only
- PIPEDA (now superseded by Bill C-27/CPPA) (Correct answer)
- CCPA
- GDPR
Correct answer: PIPEDA (now superseded by Bill C-27/CPPA)
PIPEDA (Personal Information Protection and Electronic Documents Act), currently being replaced by Bill C-27, governs how private-sector organizations in Canada collect, use, and disclose personal information.
Question 5: What does 'pseudonymization' mean in the context of GDPR compliance for a WordPress database?
- Deleting user data after 30 days
- Replacing directly identifying information with artificial identifiers so data cannot be attributed to a specific person without additional information (Correct answer)
- Encrypting the entire WordPress database
- Using fake names in user profiles
Correct answer: Replacing directly identifying information with artificial identifiers so data cannot be attributed to a specific person without additional information
Pseudonymization replaces identifying fields with artificial identifiers, reducing privacy risk while the additional key needed for re-identification is stored separately.
Question 6: Which of the following actions must a WordPress site take under CAN-SPAM for every commercial email it sends?
- Include the physical postal address of the sender (Correct answer)
- Send only during business hours
- Use HTML format only
- Limit the email to 500 words
Correct answer: Include the physical postal address of the sender
CAN-SPAM requires every commercial email to include the sender's valid physical postal address to ensure accountability and enable contact.
Question 7: When using WordPress with a third-party payment gateway for PCI DSS compliance, which approach best reduces the site's PCI scope?
- Storing card numbers in a custom database table
- Using a hosted payment page or tokenization so card data never touches WordPress servers (Correct answer)
- Encrypting card data with a WordPress plugin
- Disabling SSL and using basic HTTP
Correct answer: Using a hosted payment page or tokenization so card data never touches WordPress servers
Hosted payment pages and tokenization keep cardholder data off the WordPress server entirely, dramatically reducing PCI DSS scope and compliance burden.
WordPress Regulatory Frameworks & Compliance 5
When a WordPress site suffers a data breach exposing EU residents' personal data, within how many hours must the data controller notify the relevant supervisory authority under GDPR?