CISM Certification Domain 1: Information Security Governance Video Boot Camp 2019 - GDPR (General Data Protection Regula

The video tutorial explains the General Data Protection Regulation (GDPR) enacted in 2018, highlighting its comprehensive approach to data protection and privacy in the EU and EEA. It contrasts the EU's proactive stance with the US's reactive approach. The tutorial covers the scope of GDPR, emphasizing that it applies based on customer location, not company location. It details potential fines for non-compliance, the importance of consent for data processing, and the rights of individuals, such as the right to be forgotten and data portability. The video also outlines the requirement for breach notifications within 72 hours and the necessity of appointing a data protection officer for companies involved in data processing.

What is the primary factor that determines whether a company must comply with GDPR?

• The location of the company's headquarters

• The nationality of the company's employees

• The location of the company's customers

• The size of the company's annual revenue

Which of the following is considered personal data under GDPR?

• A list of company suppliers

• A company's annual report

• A public holiday calendar

• An individual's IP address

Under what circumstances can personal data be processed without consent according to GDPR?

• For improving customer service

• If required by national security

• For marketing purposes

• If the data is publicly available

What is the maximum time allowed for notifying users and data controllers of a data breach under GDPR?

• 48 hours

• 24 hours

• 72 hours

• One week

What role must a company appoint if its activities involve data processing and monitoring?

• Chief Executive Officer

• Data Protection Officer

• Chief Financial Officer

• Human Resources Manager