Privacy Laws and Regulations CDPSE Practice Questions (Page 6)

Questions 26–27

1. 26application · medium

   A data controller receives a request from a data subject to delete all personal data. The controller has a legal obligation to retain certain financial records for tax purposes. Under the GDPR, how should the controller respond?

   • ADelete the data that is not subject to the legal retention requirement and inform the data subject of the data that must be retained.
   • BDelete all personal data immediately, as the right to erasure is absolute.
   • CRefuse the request entirely because the legal obligation to retain data overrides all other rights.
   • DAnonymize the financial records instead of deleting them, as this satisfies the erasure request.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   Both the GDPR and the CCPA/CPRA require organizations to provide consumers with a privacy notice. What is a common requirement of these notices?

   • AThe exact legal basis for each processing activity
   • BDisclosure of the categories of personal information collected and the purposes for which it is used
   • CThe name and contact information of the data protection officer (DPO)
   • DA list of all third parties that have ever received the consumer's data
   Reveal Solution Discussion Select an answer first