Privacy — Quiz

1. A US-based software company sells its products globally, including to customers in France, Germany, and Spain. The company collects customer names, email addresses, IP addresses, and usage analytics from all customers. A European data protection authority investigates the company for privacy violations. The company argues that as a US company, EU law does not apply to it. Is the company correct?

A. Yes; GDPR only applies to companies physically located within EU member states B. No; GDPR has extraterritorial scope and applies to any organization anywhere in the world that collects or processes personal data of EU residents, regardless of where the organization is located — a US company with EU customers must comply with GDPR for those customers' data C. No; but only the IP address collection is covered by GDPR since other data types are covered by US privacy laws D. Yes; GDPR enforcement authority is limited to companies with physical offices in EU member states

2. A customer who previously purchased products from an online retailer submits a formal request asking the retailer to delete all personal data associated with their account, as they have not purchased anything in 3 years and withdraw any consent they previously gave. The retailer's legal team confirms there is no ongoing legal obligation requiring retention of this customer's data. Under GDPR, what right is the customer exercising, and what must the retailer do?

A. Right to data portability; the retailer must provide the customer's data in machine-readable format B. Right to erasure (right to be forgotten); the retailer must delete all the customer's personal data from its systems, including backups and archives, since the data is no longer needed for the original purpose and the customer has withdrawn consent C. Right to access; the customer is requesting review of what data is held before deciding whether to continue the relationship D. Right to rectification; the customer wants incorrect data corrected or removed from the retailer's systems

3. A healthcare company uses a cloud provider to host patient medical records. The healthcare company decides what patient data to collect, for what medical purposes it is used, and how long it is retained. The cloud provider stores and manages the data according to the healthcare company's instructions but makes no independent decisions about the data's purpose or use. What roles do the healthcare company and cloud provider hold respectively under GDPR?

A. The cloud provider is the data controller because it has physical custody of the data; the healthcare company is the data processor because it enters data into the system B. The healthcare company is the data controller (determines the purpose and means of processing; primary GDPR accountability); the cloud provider is the data processor (processes data on the controller's behalf, under the controller's instructions, without independent purpose determination) C. Both are data controllers because both have access to the patient data D. The healthcare company is the data owner (GDPR term for the patient accountability role); the cloud provider is the data controller (manages the technical infrastructure)

4. A company assigns the following responsibilities to a database administrator: classify all database records as public, internal, confidential, or restricted based on the data owner's policy decisions; configure role-based access controls so only authorized roles can query each classification tier; apply encryption at rest to all confidential and restricted tables; maintain daily backup verification logs; and investigate access anomalies flagged by the SIEM. What data role does this describe?

A. Data Owner; the administrator is making classification decisions for the organization's data B. Data Custodian (Data Steward); the administrator implements and maintains the day-to-day technical controls that protect data — assigning labels, enforcing access, applying encryption, verifying backups, and monitoring access — based on policy set by the data owner, not their own independent authority C. Data Controller; the administrator controls all access to the database systems D. Data Processor; the administrator processes data queries on behalf of business units that own the data

5. A company suffers a ransomware attack that encrypts 15 servers. Incident responders need to immediately determine: which servers held personal data subject to GDPR notification requirements, who is the accountable business owner for each affected dataset, what sensitivity classification applies to each dataset, and how to communicate breach scope to regulators. What asset management document would provide all of this information?

A. The penetration test report; it identifies which servers hold valuable data based on exploitation findings B. The data inventory (data map); it catalogues all personal data by type, owner, location, format, and sensitivity classification — providing incident responders with immediate scoping information for breach impact assessment and regulatory notification decisions C. The business continuity plan; it identifies which systems are most critical to business operations D. The risk register; it documents identified risks associated with each server that was attacked

6. A company's data retention policy requires deleting all customer transaction records older than 7 years. An automated process runs monthly to purge records that have exceeded this retention period from the production database. A compliance audit later reveals that the purged transaction records are still present in monthly backup archives retained for 10 years and in a data warehouse used for historical analytics. What problem does this reveal?

A. The retention policy is too aggressive; 7 years is insufficient for transaction records under applicable regulations B. The deletion process is incomplete; effective data retention requires purging data from all locations including backup archives and secondary data stores — deleting records from the production database while they remain in backups and analytics systems does not constitute compliant deletion under GDPR or other privacy regulations C. The backup archive retention (10 years) is within acceptable limits and no compliance issue exists D. The data warehouse is not subject to the same retention policy as the production database; analytics data has different regulatory treatment

Matching: Data Roles

Match each data role (1–4) to its correct description (A–D).

1Data Owner

2Data Controller

3Data Processor

4Data Custodian

AThe technical role responsible for implementing day-to-day data protection controls including sensitivity labeling, access control enforcement, encryption, backup verification, and access monitoring

BThe senior business executive accountable for a data category; makes classification, access, and retention decisions; accepts residual risk on behalf of the business unit

CThe GDPR-defined entity that determines the purpose and means of processing personal data; bears primary legal accountability for compliance and cannot fully delegate that accountability to processors

DAn entity that processes personal data on behalf of and under the instructions of the controller; does not independently determine the purpose or use of the data; bound by a data processing agreement