Privacy Laws and Regulations CDPSE Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A French company transfers employee data to its US parent company for centralized HR management. The company currently relies on Standard Contractual Clauses (SCCs). Following the Schrems II decision, which additional measure is most directly required to ensure the transfer is lawful?

   • AAnonymize all employee data before transferring it to the US.
   • BRely on the EU-US Data Privacy Framework, which automatically legitimizes all transfers to US companies.
   • CConduct a transfer impact assessment (TIA) to evaluate the level of protection in the US and implement supplementary measures if needed.
   • DObtain explicit consent from each employee for the data transfer to the US.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   When a new privacy law is enacted that affects an organization's data processing, what is the first step the organization should take to maintain compliance?

   • AWait for the law to be enforced before making changes
   • BAssess the impact of the new law on current data processing activities
   • CImmediately delete all personal data to avoid violations
   • DUpdate the privacy policy without reviewing other processes
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A privacy team is monitoring regulatory changes. They learn that a new law in a country where they operate will require data localization. The company currently stores data in a neighboring country. Which action is most appropriate?

   • ABegin planning to move data to the country where the law will take effect, considering the cost and timeline.
   • BIgnore the law because it only applies to companies headquartered in that country.
   • CWait for the law to be enacted before taking any action.
   • DContinue storing data in the neighboring country and rely on the existing DPA.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A company in Singapore processes data of Singapore residents and also has a subsidiary in South Korea that processes data of South Korean residents. Which laws apply to the company's processing?

   • AGDPR, because the company operates in Asia.
   • BPDPA (Singapore) for Singapore residents and PIPA (South Korea) for South Korean residents.
   • CPIPA (South Korea) only, because the subsidiary is in South Korea.
   • DPDPA (Singapore) only, because the parent company is in Singapore.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A Canadian company provides cloud-based project management software to clients in Canada and the US. The company processes personal data of its clients' end-users, who are located in Canada and the US. The company has no physical presence in the EU. Which privacy law is most likely to apply to the company's processing of end-user data?

   • ACCPA/CPRA, because the company has US clients, even though it has no California presence.
   • BNo privacy law applies because the company is not in the EU and does not have a physical presence there.
   • CGDPR, because the company processes data of individuals in North America, which is a global market.
   • DPIPEDA, because the company is Canadian and processes data of Canadian residents.
   Reveal Solution Discussion Select an answer first