Certified Information Privacy Professional CCPA and CPRA Compliance 3

Question 1

What must a business's privacy notice include under the CCPA 'notice at collection' requirement?

Accepted Answer

Categories of personal information collected and the purposes for collection

Answer

The full names of all employees handling data

Answer

The business's profit margins from data use

Answer

A complete list of all third parties who receive data

Question 2

Under CCPA, how long does a business have to respond to a verifiable consumer request to know or delete?

Accepted Answer

45 days, extendable by another 45 days with notice

Answer

30 days with no extensions

Answer

60 days with no extensions

Answer

90 days, extendable to 180 days

Question 3

Which CPRA provision requires businesses to conduct risk assessments before undertaking high-risk processing activities?

Accepted Answer

Privacy risk assessment (DPIA-like) requirement for high-risk processing

Answer

Annual financial audits of data practices

Answer

Mandatory third-party penetration testing

Answer

Consumer opinion surveys on data use

Question 4

The CCPA applies to for-profit businesses that buy, receive, or sell personal information of how many California consumers annually?

Accepted Answer

100,000 or more consumers or households

Answer

500,000 or more consumers

Answer

50,000 or more consumers

Answer

1 million or more consumers

Question 5

Under CCPA's non-discrimination provision, businesses cannot penalize consumers for exercising their privacy rights UNLESS they:

Accepted Answer

Offer a financially-valued program that requires personal information to provide the service

Answer

Operate in a regulated industry like healthcare

Answer

Have fewer than 10 employees

Answer

Are a non-profit organization

Question 6

What CPRA requirement applies to businesses that engage in 'profiling' consumers in ways that significantly affect them?

Accepted Answer

Right to opt out of automated decision-making and profiling

Answer

Right to sue for emotional damages

Answer

Mandatory government approval before profiling

Answer

Annual notification to the state AG