Discuss IAPP CIPP/E Exam Topic 5 Question 25

To provide evidence of GDPR compliance, a company performs an internal audit. As a result, it finds a data base, password-protected, listing all the social network followers of the client.

Regarding the domain of the controller-processor relationships, how is this situation considered?

ACompliant with the security principle, because the data base is password-protected.

BNon-compliant, because the storage of the data exceeds the tasks contractually authorized by the controller.

CNot applicable, because the data base is password protected, and therefore is not at risk of identifying any data subject.

DCompliant with the storage limitation principle, so long as the internal auditor permanently deletes the data base.

Suggested Answer: B

Get Premium CIPP/E Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

13 comments · newest first

Charlie 1 year ago

Not sure if D makes sense, deleting doesn't fix the initial issue.

Carylon 1 year ago

Password protection doesn't mean compliance, folks.

Patti 1 year ago

Wait, how can they just keep a list of followers like that?

Holley 1 year ago

Totally agree, B is the right choice here.

Dorthy 1 year ago

It's still a breach if the data isn't needed!

Pauline 1 year ago

I feel like option C is misleading; just because it's password-protected doesn’t mean it’s not identifiable. I’m confused about the right answer.

Stevie 1 year ago

I practiced a similar question, and I think just being password-protected isn’t enough for GDPR compliance. Could it be option B?

Agustin 1 year ago

I’m not sure, but I think the storage limitation principle might apply here. Maybe option D is correct if the data is deleted?

Essie 1 year ago

I remember discussing how password protection alone doesn't guarantee compliance, so I’m leaning towards option B.

Suzi 1 year ago

Okay, I think the key here is to focus on the "best" reason, not just any reason. I'll need to weigh the pros and cons of each option.

Lizette 1 year ago

This looks like a pretty straightforward VLAN planning question. I'll focus on the key principles like number of VLANs, customer types, and business requirements.

Luz 1 year ago

Hmm, this seems to be testing our understanding of different business objectives. I'll need to carefully consider the information provided and think through the key factors at play.

Dorathy 1 year ago

I feel like they have to use a specialized approach for mental health services, so "carve-out" sounds right to me, but I wish I could remember more details.

IAPP CIPP/E Exam - Topic 5 Question 25 Discussion