Understand Privacy Issues CCSP Practice Questions (Page 5)

Questions 21–24

1. 21foundation · easy

   Which of the following is a typical step in conducting a Privacy Impact Assessment?

   • APublishing the system's source code to the public
   • BDeleting all personal data to avoid any privacy risks
   • CHiring an external auditor to certify the system
   • DIdentifying the personal data flows and the purposes for which the data is collected
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A multinational corporation with operations in the EU, US, and India is designing a global HR system. The system will store employee data in a single data center in the US. The company is subject to GDPR for its EU employees, and India's Digital Personal Data Protection Act (DPDPA) for its Indian employees. The company wants to minimize compliance complexity while ensuring lawful processing. Which approach best balances compliance with both regulations?

   • AStore all employee data in the EU and rely on GDPR's adequacy for US transfers.
   • BStore all employee data in the US and implement binding corporate rules (BCRs) for the entire group.
   • CStore all employee data in the US and rely on standard contractual clauses for EU data and consent for Indian data.
   • DStore EU employee data in the EU and Indian employee data in India, with separate data processing agreements for each region.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A company is planning to deploy a new AI-based recruitment system that will process personal data of job applicants in the EU. The system will use automated decision-making to shortlist candidates. The company's DPO has determined that a DPIA is required. What is the most important factor to consider in the DPIA?

   • AThe cost of implementing the system
   • BThe location of the data center
   • CThe accuracy and fairness of the automated decision-making algorithm
   • DThe number of job applicants
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Why do data privacy requirements vary across jurisdictions?

   • ABecause each jurisdiction has its own legal, cultural, and political context that shapes its privacy laws
   • BBecause international standards like ISO/IEC 27018 are legally binding
   • CBecause all countries have the same legal definitions of personal data
   • DBecause cloud providers choose which laws to follow
   Reveal Solution Discussion Select an answer first