Subject Rights Flashcards
7 cards from real CDPSE practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Subject Rights flashcards as text
Under the CCPA, a consumer's right to opt-out applies specifically to which activity?
Answer: Sale of personal information to third parties
The CCPA's right to opt-out targets the sale of personal information to third parties, not internal processing or contracted service providers.
A data subject submits a right-of-access request but cannot verify their identity. What is the organization's best course of action?
Answer: Request additional identity verification information before fulfilling the request
Organizations should request additional verification before fulfilling access requests to prevent unauthorized disclosure of personal data.
Which GDPR article establishes the right to erasure ('right to be forgotten')?
Answer: Article 17
GDPR Article 17 establishes the right to erasure, allowing data subjects to request deletion of their personal data under specific conditions.
An organization receives a data portability request. In which format must the data be provided?
Answer: A structured, commonly used, machine-readable format
GDPR Article 20 requires that data provided for portability be in a structured, commonly used, machine-readable format such as CSV or JSON.
Which condition allows an organization to REFUSE a right-to-erasure request under GDPR?
Answer: The data is necessary for compliance with a legal obligation
GDPR Article 17(3) permits refusal of erasure requests when retention is necessary to comply with a legal obligation.
Under the CCPA, how many days does a business have to respond to a verifiable consumer request?
Answer: 45 days
The CCPA requires businesses to respond to verifiable consumer requests within 45 calendar days, extendable by another 45 days with notice.
What does the right to restriction of processing allow a data subject to do under GDPR?
Answer: Limit how the controller uses their data while a dispute is resolved
The right to restriction (Article 18) allows data subjects to limit processing of their data, for example while contesting its accuracy.