ACFE Exam CFE-Law Topic 1 Question 43 Discussion

Actual exam question for ACFE's CFE-Law exam

Question #: 43
Topic #: 1

Which of the following is NOT a requirement of the European Union's (EU) General Data Protection Regulation (GDPR)?

AAn organization must delete a data subject's personal data automatically when the data are no longer m use.

BAn organization must have a documented lawful basis for collecting or processing personal data.

CAn organization generally must notify all affected data subjects without undue delay when a high-risk data breach occurs

DAn organization must confirm or deny that it possesses a data subject's personal data upon that individual's request

Show Suggested Answer

Suggested Answer: B

by Gabriele at Aug 05, 2024, 10:13 AM

Limited Time Offer

25%

Off

Get Premium CFE-Law Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Latricia

3 months ago

Haha, they're really trying to catch us out with these GDPR questions. I bet the legal team at my company has a field day with this stuff.

upvoted 0 times

Lili

3 months ago

B) An organization must have a documented lawful basis for collecting or processing personal data.

upvoted 0 times

...

Rusty

3 months ago

C) An organization generally must notify all affected data subjects without undue delay when a high-risk data breach occurs

upvoted 0 times

...

Lisbeth

3 months ago

B) An organization must have a documented lawful basis for collecting or processing personal data.

upvoted 0 times

...

Hillary

3 months ago

A) An organization must delete a data subject's personal data automatically when the data are no longer in use.

upvoted 0 times

...

Roxane

3 months ago

A) An organization must delete a data subject's personal data automatically when the data are no longer in use.

upvoted 0 times

...

Jess

4 months ago

You're right, that is also a crucial requirement. It's a tough question, but I still think C) is the correct answer.

upvoted 0 times

...

Kirby

4 months ago

But what about B) An organization must have a documented lawful basis for collecting or processing personal data? That seems like a pretty important requirement too.

upvoted 0 times

...

Leonora

4 months ago

This is a tricky one! I have to double-check my GDPR knowledge. *frantically flips through notes*

upvoted 0 times

...

Jess

4 months ago

I disagree, I believe the answer is A) An organization must delete a data subject's personal data automatically when the data are no longer in use.

upvoted 0 times

...

Rosenda

4 months ago

I'm pretty sure the GDPR mandates notifying data subjects about high-risk breaches. C can't be the answer.

upvoted 0 times

Julieta

3 months ago

D) An organization must confirm or deny that it possesses a data subject's personal data upon that individual's request.

upvoted 0 times

...

Berry

3 months ago

B) An organization must have a documented lawful basis for collecting or processing personal data.

upvoted 0 times

...

Rochell

3 months ago

A) An organization must delete a data subject's personal data automatically when the data are no longer in use.

upvoted 0 times

...

Isadora

4 months ago

B sounds like the correct answer to me. Organizations need a legal basis to process personal data under the GDPR.

upvoted 0 times

...

Mona

4 months ago

Hmm, I'm not sure about this one. I thought the GDPR required automatic deletion of data after it's no longer needed.

upvoted 0 times

Cecil

3 months ago

D) An organization must confirm or deny that it possesses a data subject's personal data upon that individual's request

upvoted 0 times

...

Sylvie

3 months ago

C) An organization generally must notify all affected data subjects without undue delay when a high-risk data breach occurs

upvoted 0 times

...

Portia

4 months ago

B) An organization must have a documented lawful basis for collecting or processing personal data.

upvoted 0 times

...

Arletta

4 months ago

A) An organization must delete a data subject's personal data automatically when the data are no longer in use.

upvoted 0 times

...

Kirby

4 months ago

I think the answer is C) An organization generally must notify all affected data subjects without undue delay when a high-risk data breach occurs.

upvoted 0 times

...