Compliance and Data Protection Quiz

A healthcare startup wants to deploy a new telemedicine platform that uses patient health data for AI-driven diagnosis. The CTO insists encryption is enough for compliance. Which approach best ensures legal, technical, and operational readiness?

• Encrypt all patient data, rely on implied consent, and launch the system to test market adoption

• Conduct a DPIA, obtain explicit consent, implement encryption and access control, and train staff before deployment

• Limit data use to anonymized datasets and skip DPIA since anonymization removes risk

• Draft a privacy notice after launch to reflect actual system use

A retail bank uses a foreign vendor to process loan applications, storing applicant data overseas. The compliance officer wants to block the transfer until safeguards are in place, but operations argue delays will hurt business. Which option balances compliance and operational needs?

• Proceed immediately and backdate compliance documentation

• Require contractual clauses, conduct a transfer risk assessment, and encrypt data during transit and at rest

• Encrypt data only and rely on the vendor’s privacy certification

• Use anonymized data for processing and add identifiers later without notifying the regulator

A marketing agency plans to re-use customer emails collected for service updates to promote a new product line. Which action is most compliant?

• Send marketing emails immediately, assuming customers will unsubscribe if uninterested

• Obtain separate, specific consent for marketing purposes and update the privacy notice

• Add marketing terms to the existing service contract retroactively

• Use a legitimate interest basis without offering an opt-out

A multinational manufacturer’s HR system integrates with a third-party benefits provider. The provider subcontracts part of the processing without informing the manufacturer. Which is the most appropriate action?

• Accept the subcontract if the provider guarantees data security

• Suspend processing until the subcontract is reviewed, authorized, and added to the processing agreement

• Ignore the subcontract as long as no breach occurs

• Require staff to sign new consent forms for the same purpose

A public university’s research team wants to collect ethnicity and health data from students to study wellness patterns. Time pressure means they suggest skipping the DPIA and anonymizing data later. Which is the best approach?

• Proceed with collection under implied consent, anonymizing later

• Conduct a DPIA before collection, obtain explicit consent, and design anonymization into the process

• Skip consent since research is in the public interest

• Anonymize data after publication only

A fintech firm launches a feature allowing customers to share spending data with third-party budgeting apps. The legal team insists on controller-to-controller agreements. Which factor most strongly supports this requirement?

• Data is being shared in aggregated format only

• The budgeting apps independently decide purposes and means of processing

• Customers voluntarily sign up for the apps

• The fintech encrypts all data before sharing

During a privacy audit, you discover that ROPA entries for several processes list retention as “indefinite.” Operations says this is needed for analytics. Which is the most compliant response?

• Accept indefinite retention for analytics purposes

• Require defined retention periods based on necessity and legal requirements

• Allow indefinite retention if data is encrypted

• Permit indefinite retention if users are notified

Which action aligns with PDP Law requirements regarding data retention periods?

• Keep “indefinite” if analytics could be useful in the future

• Define retention periods aligned with legal obligations and justify any extensions

• Remove retention information from ROPA to avoid conflicts

• Set all retention periods to 1 year regardless of purpose

A government agency processes citizen data for issuing ID cards. After contract fulfillment, what should the controller require the vendor to do with the data, according to PDP Law and ISO 27701?

• Allow storage if the vendor signs a non-disclosure agreement

• Require deletion or anonymization after contract fulfillment, in line with PDP Law and ISO 27701

• Permit storage for vendor business continuity

• Transfer data back to the agency after 5 years without checking storage security

If a company experiences a data breach involving encrypted files but the encryption key was compromised, what is the correct compliance action under PDP Law?

• Notify the regulator and affected individuals within the legal timeframe

• Skip notification since the files were encrypted

• Delay notification until the investigation is complete, regardless of deadlines

• Notify only affected individuals but not the regulator