GRC GRC Data Privacy and Information Governance 1 — Questions and Answers
Question 1: Which U.S. federal law primarily governs the privacy of health information held by covered entities and their business associates?
- FERPA
- HIPAA (Correct answer)
- GLBA
- CCPA
Correct answer: HIPAA
HIPAA (Health Insurance Portability and Accountability Act) establishes national standards for protecting sensitive patient health information.
Question 2: Under the NIST Privacy Framework, which core function focuses on developing organizational understanding to manage privacy risk?
- Protect
- Identify-P (Correct answer)
- Respond-P
- Control
Correct answer: Identify-P
The Identify-P function in the NIST Privacy Framework helps organizations understand the privacy risks associated with data processing activities.
Question 3: A data governance policy that defines who can access, modify, and delete data is best described as a:
- Data retention schedule
- Data stewardship policy
- Data access control policy (Correct answer)
- Data classification matrix
Correct answer: Data access control policy
A data access control policy formally defines the rules governing who may access, alter, or remove organizational data assets.
Question 4: Which concept requires organizations to collect only the minimum amount of personal data necessary for a stated purpose?
- Data minimization (Correct answer)
- Data sovereignty
- Data portability
- Data residency
Correct answer: Data minimization
Data minimization is the principle of limiting personal data collection to what is directly relevant and necessary to accomplish a specified purpose.
Question 5: The California Consumer Privacy Act (CCPA) grants California residents the right to:
- Sue employers for wage theft
- Know what personal data is collected about them and request its deletion (Correct answer)
- Access competitor pricing information
- Opt out of paying state taxes on data services
Correct answer: Know what personal data is collected about them and request its deletion
CCPA gives California residents rights including knowing what personal data businesses collect, the right to delete it, and the right to opt out of its sale.
Question 6: In information governance, a 'data owner' is best defined as:
- The IT administrator who backs up the data
- The business unit accountable for the accuracy and use of a data set (Correct answer)
- The vendor who stores the data on their servers
- The auditor who reviews data quality annually
Correct answer: The business unit accountable for the accuracy and use of a data set
A data owner is typically a senior business stakeholder who holds accountability for the integrity, security, and appropriate use of a specific data set.
GRC GRC Data Privacy and Information Governance 1
Which U.S. federal law primarily governs the privacy of health information held by covered entities and their business associates?