Q34. If XYZ & Co. collects, stores and processes personal information of living persons, electronically in a structured filing system, then XYZ could be a:

Q35. After the rules were notified under section 43A of the IT (Amendment) Act, 2008, a clarification was issued
by the government which exempted the service providers, which get access to/processes Sensitive Personal
Data or information (SPDI) under contractual agreement with a legal entity located within or outside India.
Which privacy principle provisions notified under Sec 43A were exempted for the service providers?

Q36. ABC Health Care is a large healthcare delivery chain, with 8 hospitals and more than 20 health centers. It has decided to streamline its patient care system. The new system needs to integrate data from more than 20 clinical, scheduling, and billing systems. It needs to support all types of data-intensive projects, which includes masking sensitive health information.
You have been approached to address privacy concerns during integration of the new system. Arrange the below listed steps in sequential order for the most appropriate implementation of privacy protection measures.
I. Creating a privacy policy to safeguard the sensitive personal data
II. Measuring and monitoring privacy policy and processes implementation to provide ongoing proof that data has been protected III. Defining and classifying sensitive personal data, including data and metadata patterns IV. Masking data consistently across the systems to meet various compliance standards
V. Discovering where the sensitive personal data is stored across databases, applications, endpoints and servers Please select the most logical sequence from below options:

Q37. Which of the following legislations/ guidelines do not cover the concept of trans-border data flow?

Q38. Which among the following can be classified as the most important purpose for enactment of data protection/
privacy regulations across the globe?

Q39. A company collects personal information about its employees and requests them to provide accurate information in order to avail benefits such as life insurance and medical insurance. Employees of the company have raised concerns about use of their personal information. Due to the concerns, the company has decided to create a privacy policy. What all should the company include in its privacy policy to address the raised concerns?

Q40. Which of the following provides the legal basis for an Adjudicating Officer in every Indian state & union
territory, with the powers of a civil court, to hear complaints and order compensation to the affected
individuals?

Q41. From the following list, select the element (elements) that comprise APEC’s cross border privacy rules system:

Q42. What is the standard definition for Data Controller?

Q43. General Data Protection Regulation, 2016 applies to processing of personal data of natural persons that are:

Q44. Please select the incorrect statement in context of “Online Privacy”:

Q45. What are the roles an organization can play from privacy perspective?
i. Data Controller – determines the means and purpose of processing of data which is collected from its end customers ii. Data Controller – determines the means and purpose of processing of data which is collected from its employees iii. Data Sub-Processor – processes personal data on behalf of data processor iv. Joint Controller – determines the means and purpose of data processing along with other data controller Please select correct option:

Q46. A government agency collecting biometrics of citizens can deny sharing such information with Law
Enforcement Agencies (LEAs) on which of the following basis?

Q47. Historically, which of these events led to the formation of our current concept of privacy?

Q48. Which of the following are key contributors that would enhance the complexity in implementing security measures for protection personal information?

Q49. Which of the following mechanisms or steps are likely to be taken by an organization for implementing
privacy program?
i Deploying physical and technology safeguards to protect personal information assets
ii. Privacy consideration in product and service design
iii. Privacy implementation to focus only on projects impacted by privacy breaches
iv. Benchmarking against industry peers’ privacy implementation
v. Installing privacy enhancing tools and technologies for the projects dealing with organization’s intellectual
property
Please select the correct set of statements from the below options:

Q50. In the history of human evolution, erection of walls and fences around one’s living spaces is interpreted as
arrival of which type of privacy consciousness?

Q51. Companies based in EU and willing to transfer data outside the EU/EEA, use model contracts as an instrument.
Which of the following statements are true in reference to above statement?

Q52. Which of the following privacy principle deals with informed consent of the data subject before sharing the personal information (of the data subject) to third parties for processing?

Q53. Which of the following could be considered as triggers for updating privacy policy?

Q54. As per Article 33 of GDPR, in case of a personal data breach, the data controller has to inform the supervisory authority within ___________ of becoming aware of the breach.

Q55. According to the EU-US Safe Harbour Framework, which of the following is not required when transferring personal information from EU member nations to the US?