Privacy Laws and Regulations CDPSE Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   A company transfers personal data of EU residents to a third-party processor in the United States. Under the GDPR, which of the following is a valid mechanism for this transfer?

   • AA simple data processing agreement
   • BStandard Contractual Clauses (SCCs)
   • CThe CCPA/CPRA's opt-out mechanism
   • DThe organization's privacy policy
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   A U.S.-based company that provides online services to customers in the European Union processes the personal data of those EU customers. Which privacy law is most directly applicable to this processing activity?

   • AThe General Data Protection Regulation (GDPR)
   • BThe California Consumer Privacy Act (CCPA)
   • CThe Payment Card Industry Data Security Standard (PCI DSS)
   • DThe Health Insurance Portability and Accountability Act (HIPAA)
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A company collects customer data for marketing purposes. Under GDPR, the company relies on legitimate interest as its legal basis. A customer objects to the processing. Which action is most appropriate?

   • AAsk the customer to provide a reason for the objection before deciding whether to stop processing.
   • BStop processing immediately because the customer's objection is absolute.
   • CContinue processing because legitimate interest is a valid basis that overrides any objection.
   • DStop processing unless the company can demonstrate compelling legitimate grounds that override the customer's interests, rights, and freedoms.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A California-based startup collects user email addresses to send a weekly newsletter. The startup also sells user email lists to third-party marketers. Under the CCPA/CPRA, which practice is most directly non-compliant?

   • ASelling email addresses without first offering an opt-out mechanism to consumers.
   • BCollecting email addresses without obtaining explicit opt-in consent for the newsletter.
   • CProviding a 'Do Not Sell My Personal Information' link on the homepage.
   • DStoring email addresses on servers located outside California.
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A global company processes data of EU, UK, and California residents. The company has a single privacy policy that states it 'may share personal data with third parties for business purposes.' Under GDPR, UK GDPR, and CCPA/CPRA, which issue is most likely to arise?

   • AThe policy is too vague to satisfy the GDPR's transparency requirement, which requires specific purposes for processing.
   • BThe policy is compliant with all three laws because it is a single, unified policy.
   • CThe policy violates CCPA/CPRA because it does not provide a 'Do Not Sell' link.
   • DThe policy is compliant with UK GDPR because it uses the term 'personal data'.
   Reveal Solution Discussion Select an answer first