BlackFriday 2024! Hurry Up, Grab the Special Discount - Save 25% - Ends In 00:00:00 Coupon code: SAVE25

- Free Preparation Discussions

IAPP Exam CIPP-US Topic 7 Question 69 Discussion

Actual exam question for IAPP's CIPP-US exam

Question #: 69
Topic #: 7

[All CIPP-US Questions]

Which of the following conditions would NOT be sufficient to excuse an entity from providing breach notification under state law?

AIf the data involved was encrypted.

BIf the data involved was accessed but not exported.

CIf the entity was subject to the GLBA Safeguards Rule.

DIf the entity followed internal notification procedures compatible with state law.

Show Suggested Answer

Suggested Answer: C

While compliance with the Safeguards Rule helps in preventing breaches and ensuring data security, it does not necessarily exempt an entity from having to provide breach notifications as required by state laws. State breach notification laws typically have their own criteria for when notification is required, which may include factors like the type of data compromised, the potential risk of harm to individuals, and other circumstances surrounding the breach. While following the GLBA Safeguards Rule may demonstrate a commitment to data security, it doesn't automatically override the notification obligations imposed by state laws when a data breach occurs.

by Gladys at Sep 16, 2024, 07:48 AM

Limited Time Offer

25%

Off

Get Premium CIPP-US Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Angella

25 days ago

Wait, is this a cybersecurity exam or a comedy show? I'm getting mixed signals here.

upvoted 0 times

...

Lashaun

26 days ago

Haha, I bet the exam writers tried to trick us with that one. Encryption is the way to go, folks!

upvoted 0 times

...

Jacklyn

27 days ago

A has to be the answer. Encryption should be a valid exemption from breach notification.

upvoted 0 times

...

Royal

28 days ago

I'm going with D. If the entity followed their own notification procedures, that should be good enough to avoid state law requirements.

upvoted 0 times

Arleen

4 days ago

A) If the data involved was encrypted.

upvoted 0 times

...

...

Frederica

1 months ago

Hmm, I'm not sure. C seems like a reasonable exemption if the entity is already subject to the GLBA Safeguards Rule.

upvoted 0 times

Charisse

3 days ago

D) If the entity followed internal notification procedures compatible with state law.

upvoted 0 times

...

Noah

4 days ago

C) If the entity was subject to the GLBA Safeguards Rule.

upvoted 0 times

...

Arleen

6 days ago

B) If the data involved was accessed but not exported.

upvoted 0 times

...

Nickole

1 months ago

A) If the data involved was encrypted.

upvoted 0 times

...

...

Wynell

2 months ago

But wouldn't following internal notification procedures be a sufficient excuse from providing breach notification under state law?

upvoted 0 times

...

Bette

2 months ago

I think the answer is B. If the data was accessed but not exported, that should still require breach notification, right?

upvoted 0 times

Lauran

1 months ago

B) If the data involved was accessed but not exported.

upvoted 0 times

...

Jettie

2 months ago

A) If the data involved was encrypted.

upvoted 0 times

...

...

Felicia

2 months ago

I disagree, I believe the correct answer is D) If the entity followed internal notification procedures compatible with state law.

upvoted 0 times

...

Wynell

2 months ago

I think the answer is C) If the entity was subject to the GLBA Safeguards Rule.

upvoted 0 times

...