Discuss IAPP CIPP/E Exam Topic 3 Question 26

What must be included in a written agreement between the controller and processor in relation to processing conducted on the controller's behalf?

AAn obligation on the processor to report any personal data breach to the controller within 72 hours.

BAn obligation on both parties to report any serious personal data breach to the supervisory authority.

CAn obligation on both parties to agree to a termination of the agreement if the other party is responsible for a personal data breach.

DAn obligation on the processor to assist the controller in complying with the controller's obligations to notify the supervisory authority about personal data breaches.

Suggested Answer: B

Get Premium CIPP/E Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

12 comments · newest first

Tijuana 1 year ago

I think both parties should be liable for breaches, right?

Asha 1 year ago

Don't forget about assisting with supervisory authority notifications!

Leonor 1 year ago

Wait, is it really 72 hours? Sounds tight!

Deeanna 1 year ago

Totally agree, that's a must-have.

Garry 1 year ago

Gotta include breach reporting within 72 hours!

Wilburn 1 year ago

I remember practicing a similar question, and I think the key point is that the processor must assist the controller with compliance obligations.

Scarlet 1 year ago

I’m a bit confused about the termination clause. I don’t recall if that’s a standard requirement in these agreements.

Lamonica 1 year ago

I think I remember that the processor has to notify the controller about breaches, but I'm not sure if it's specifically 72 hours.

Moon 1 year ago

This question feels familiar; I think we discussed the obligations of processors in class. I want to say they have to help the controller with supervisory authority notifications.

Mila 1 year ago

I'm a little confused by the options here. A demo issue and international research don't seem directly relevant to the question of public vs. private bond issuance. I'll need to think this through carefully.

Ailene 1 year ago

Communication is probably the least likely cause here. With an outsourced project, I'd expect the communication challenges to be a bigger factor than the others.

Julio 1 year ago

Ah, this is a good one. I remember learning about the different ways to switch between user accounts and credentials. I'm pretty confident I know the right answer here.

IAPP CIPP/E Exam - Topic 3 Question 26 Discussion