ACFE Exam CFE-Law Topic 1 Question 39 Discussion

Actual exam question for ACFE's CFE-Law exam

Question #: 39
Topic #: 1

Which of the following is NOT a requirement of the European Union's (EU) General Data Protection Regulation (GDPR)?

AAn organization must delete a data subject's personal data automatically when the data are no longer m use.

BAn organization must have a documented lawful basis for collecting or processing personal data.

CAn organization generally must notify all affected data subjects without undue delay when a high-risk data breach occurs

DAn organization must confirm or deny that it possesses a data subject's personal data upon that individual's request

Show Suggested Answer

Suggested Answer: B

by Noah at Jun 23, 2024, 07:48 PM

Limited Time Offer

25%

Off

Get Premium CFE-Law Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Alesia

4 months ago

D seems like the obvious answer. Who wouldn't want to confirm their data is being held?

upvoted 0 times

...

Franklyn

4 months ago

Jason

upvoted 0 times

Jenifer

3 months ago

D) An organization must confirm or deny that it possesses a data subject's personal data upon that individual's request.

upvoted 0 times

...

Jenifer

3 months ago

C) An organization generally must notify all affected data subjects without undue delay when a high-risk data breach occurs.

upvoted 0 times

...

Jenifer

3 months ago

B) An organization must have a documented lawful basis for collecting or processing personal data.

upvoted 0 times

...

Felton

3 months ago

C) An organization generally must notify all affected data subjects without undue delay when a high-risk data breach occurs.

upvoted 0 times

...

Felton

3 months ago

B) An organization must have a documented lawful basis for collecting or processing personal data.

upvoted 0 times

...

Felton

3 months ago

A) An organization must delete a data subject's personal data automatically when the data are no longer in use.

upvoted 0 times

...

Britt

4 months ago

I'll have to go with A. Automatic deletion? That's way too much to ask of organizations!

upvoted 0 times

...

Francis

4 months ago

Hmm, this is a tricky one. I'm going to go with A - that doesn't sound like a GDPR rule.

upvoted 0 times

...

Marge

4 months ago

I think the answer is D) An organization must confirm or deny that it possesses a data subject's personal data upon that individual's request.

upvoted 0 times

...

Louisa

4 months ago

C is definitely wrong. Notifying data subjects about high-risk breaches is a GDPR requirement.

upvoted 0 times

Suzan

4 months ago

B) An organization must have a documented lawful basis for collecting or processing personal data.

upvoted 0 times

...

Natalie

4 months ago

A) An organization must delete a data subject's personal data automatically when the data are no longer in use.

upvoted 0 times

...

Noel

5 months ago

B seems like the correct answer to me. Organizations need a lawful basis for data processing.

upvoted 0 times

Blondell

3 months ago

I agree, having a lawful basis for collecting or processing personal data is important.

upvoted 0 times

...

Kristin

3 months ago

D) An organization must confirm or deny that it possesses a data subject's personal data upon that individual's request

upvoted 0 times

...

Hoa

3 months ago

C) An organization generally must notify all affected data subjects without undue delay when a high-risk data breach occurs

upvoted 0 times

...

Domitila

4 months ago

B) An organization must have a documented lawful basis for collecting or processing personal data.

upvoted 0 times

...

Katy

4 months ago

A) An organization must delete a data subject's personal data automatically when the data are no longer in use.

upvoted 0 times

...

Tawanna

5 months ago

I disagree, I believe the correct answer is A) An organization must delete a data subject's personal data automatically when the data are no longer in use.

upvoted 0 times

...

Ciara

5 months ago

I think the answer is A. Automatic deletion of data is not a requirement under GDPR.

upvoted 0 times

Leota

4 months ago

That's correct, GDPR does not require automatic deletion of data.

upvoted 0 times

...

Leota

4 months ago

I agree, automatic deletion of data is not a requirement under GDPR.

upvoted 0 times

...

Genevieve

5 months ago

I think the answer is C) An organization generally must notify all affected data subjects without undue delay when a high-risk data breach occurs.

upvoted 0 times

...