A European online store collects customer names and email addresses. They provide a clear privacy policy and obtain explicit consent for marketing emails.

A company experiences a data breach involving credit card information. They notify the affected cardholders and their acquiring bank within 72 hours.

A company operating in the EU collects employee biometric data without a legal basis or explicit consent.

A small business only processes a few credit card transactions per month. They are exempt from all PCI DSS requirements.

A website uses cookies to track user browsing behavior. They provide a cookie consent banner with an option to opt-out.

A company stores customer data in a cloud environment. They are not responsible for the security of that data.

A data subject in the EU requests access to their personal data held by a company. The company ignores the request.

An organization securely deletes all cardholder data after a transaction is completed.

A company that uses third party processors for credit card processing, does not need to worry about PCI DSS compliance.

What security standard focuses specifically on protecting cardholder data?

Which regulation aims to protect the personal data of individuals?

What does "PCI" stand for in PCI DSS?

What does "GDPR" stand for?

Which standard dictates requirements for organizations that handle credit card information?

Which regulation grants individuals rights such as the "right to be forgotten"?

What type of data is the primary focus of PCI DSS?

What type of data does GDPR primarily concern itself with?

Which one is a legal regulation, PCI DSS or GDPR?

What is the term for a person appointed by an organisation to oversee data protection responsibilities under GDPR?