Regulatory and Legal Compliance ACCISO Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A multinational retailer with headquarters in the EU and data centers in the US and Asia is implementing a new customer loyalty program that will collect personal data from EU residents. The CISO must ensure the program's data handling aligns with the most stringent applicable regulation. Which framework should be the primary compliance baseline for this initiative?

   • AGDPR, because it applies to any organization processing personal data of EU residents regardless of where the processing occurs.
   • BPIPEDA, because the company has data centers in Canada and PIPEDA applies to all cross-border transfers.
   • CISO/IEC 27001, because it is the only international standard that covers both security and privacy comprehensively.
   • DCCPA, because the company has customers in California and the loyalty program is similar to a sale of personal information.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A U.S.-based healthcare provider stores electronic protected health information (ePHI) in a cloud environment. The compliance officer wants to ensure the organization meets its legal obligations for protecting this data. Which regulatory framework is most directly applicable to this scenario?

   • AGDPR
   • BHIPAA
   • CPCI DSS
   • DSOX
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A company is assessing its compliance with GDPR's requirement to protect personal data. The assessment team has identified that encryption is not used for data at rest. Which action should the team take to assess the compliance risk?

   • AEvaluate whether the lack of encryption increases the likelihood of a data breach and the potential impact on data subjects.
   • BReport the lack of encryption as a compliance violation to the supervisory authority immediately.
   • CDocument that encryption is not required because the data is not sensitive.
   • DImmediately implement encryption without further analysis, because GDPR mandates encryption in all cases.
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A global company is subject to both GDPR and CCPA. It wants to streamline its privacy program to satisfy both regulations. Which approach is most effective?

   • AComply with GDPR only, as it is the most comprehensive
   • BImplement the stricter of the two requirements for all data subjects
   • CCreate separate programs for each regulation with no overlap
   • DComply with CCPA only, as it is more recent
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A company is conducting a compliance risk assessment for GDPR. It discovers that its data retention policy keeps customer personal data for 10 years, but the stated purpose only requires 3 years. What is the most appropriate action?

   • AIgnore the issue because the company has consent from users
   • BAnonymize the data after 3 years instead of deleting it
   • CUpdate the retention policy to align with the purpose and delete data older than 3 years
   • DKeep the data for 10 years to avoid potential legal disputes
   Reveal Solution Discussion Select an answer first