A restaurant stores customer credit card numbers on a spreadsheet on their office computer. They do not encrypt this data.

• True

• False

A European online store collects customer names and email addresses. They provide a clear privacy policy and obtain explicit consent for marketing emails.

• True

• False

A company experiences a data breach involving credit card information. They notify the affected cardholders and their acquiring bank within 72 hours.

• True

• False

A company operating in the EU collects employee biometric data without a legal basis or explicit consent.

• True

• False

A small business only processes a few credit card transactions per month. They are exempt from all PCI DSS requirements.

• True

• False

A website uses cookies to track user browsing behavior. They provide a cookie consent banner with an option to opt-out.

• True

• False

A company stores customer data in a cloud environment. They are not responsible for the security of that data.

• True

• False

A data subject in the EU requests access to their personal data held by a company. The company ignores the request.

• True

• False

An organization securely deletes all cardholder data after a transaction is completed.

• True

• False

A company that uses third party processors for credit card processing, does not need to worry about PCI DSS compliance.

• True

• False