Privacy and Data Governance Programs AAIA Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A global company is deploying an AI system that processes personal data of users in California and the EU. The privacy team must ensure compliance with both CCPA and GDPR. Which practice is most likely to satisfy the requirements of both regulations simultaneously?

   • AIgnore CCPA requirements for EU users and GDPR requirements for California users, as they do not overlap.
   • BUse a data processing agreement with all vendors to ensure they comply with both laws.
   • CProvide a single, unified privacy notice that describes all data processing activities and user rights under both laws.
   • DApply GDPR's stricter consent requirements to all users globally, including those in California.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   What is the purpose of Standard Contractual Clauses (SCCs) in cross-border data transfers?

   • ATo provide a legal mechanism for transferring personal data to countries without an adequacy decision.
   • BTo replace the need for a data processing agreement.
   • CTo certify that the receiving country has adequate data protection laws.
   • DTo allow organizations to transfer data without any restrictions.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which of the following is a key requirement for secure deletion of personal data used in AI training?

   • AInforming the data subject before deletion.
   • BEnsuring that the data cannot be recovered or reconstructed.
   • CAnonymizing the data before deletion.
   • DMoving the data to an archive for future use.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Under GDPR, when must an organization notify the supervisory authority of a personal data breach?

   • AWithout undue delay and, where feasible, within 72 hours of becoming aware of the breach.
   • BOnly if the breach is reported by a third party.
   • COnly if the breach involves more than 1,000 data subjects.
   • DWithin 30 days of the breach being discovered.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Which of the following is a key characteristic of ISO/IEC 27701 as it relates to privacy programs?

   • AIt is a certification standard specifically for AI systems and their unique privacy risks.
   • BIt provides a framework for implementing a Privacy Information Management System (PIMS) and can be certified.
   • CIt is a mandatory legal requirement for all organizations processing personal data in the EU.
   • DIt focuses exclusively on data subject rights and does not address other privacy program components.
   Reveal Solution Discussion Select an answer first