Cuestionario: Purpose-Driven Data Access and Governance — 11 preguntas

1. What is the purpose of data access?

A. The legal justification for processing personal data.

B. The specific activity or goal for which data is used.

C. The classification of data based on sensitivity.

D. The individual rights of data subjects.

Answer: (B)

Explicación

The purpose of data access is the business objective or goal for which data is used, such as marketing, analytics, or reporting, as explicitly defined in the source content.

2. Who defines the list of legally permitted purposes for intended data usage?

A. Data Users or Requesters

B. Data Governance, Legal, and Security teams

C. Data Subject

D. External Regulatory Authorities

Answer: (B)

Explicación

The list of legally permitted purposes is predefined by Data Governance, Legal, and Security teams to ensure compliance with legal standards and organizational policies, as explicitly stated in the content.

3. What is the primary role of purpose definition in data governance?

A. To define the business objective for which data is used

B. To classify data into categories like PII or PHI

C. To specify the legal basis for data processing

D. To determine who can access the data

Answer: (A)

Explicación

Purpose definition establishes the business objective for data use, guiding how data should be accessed, filtered, and used to align with organizational goals and compliance.

4. When was the 'Legal Purpose List' first established within the data governance framework?

A. After the implementation of purpose filtering mechanisms

B. Simultaneously with the purpose selection process

C. After the purpose was defined but before purpose selection processes

D. Before the purpose definition was formalized

Answer: (C)

Explicación

The 'Legal Purpose List' was established after the purpose was defined as a key concept in data governance but before the purpose selection process was fully operational, to ensure that only permitted purposes are used for data access.

5. How does the Purpose Selection Process differ from Intended Data Usage?

A. It describes the specific activity performed with data after access.

B. It is the process of defining the overall business objective for data.

C. It involves explicitly choosing a purpose during data access requests.

D. It refers to the list of legally permitted purposes established by governance.

Answer: (C)

Explicación

The Purpose Selection Process differs from Intended Data Usage because it involves explicitly choosing a purpose at the time of data access, whereas Intended Data Usage describes how data is used after access has been granted.

6. Who is credited with proposing the concept of risks associated with unknown purpose in data management?

A. The Data Subject rights advocates

B. The GDPR regulatory framework

C. The Privacy and Data Protection Authorities

D. Data Governance and Security teams

Answer: (B)

Explicación

The GDPR explicitly emphasizes the importance of purpose limitation and recognizes the risks associated with unknown or undefined purposes, making it the entity credited with proposing this concept in the context of data management and privacy.

7. What is a primary cause of preventing data misuse in access control systems?

A. Restricting user access to only non-sensitive data

B. Implementing access filtering elements such as purpose, taxonomy, and consent

C. Reducing the number of data governance policies

D. Increasing the number of data access requests

Answer: (B)

Explicación

Implementing access filtering elements like purpose, taxonomy, and consent directly causes the prevention of data misuse by ensuring data is accessed and used appropriately according to defined rules.

8. How should organizations apply the relationship between purpose and data taxonomy in practice?

A. Use purpose to set data retention periods based on data classification

B. Apply purpose and taxonomy to determine access filtering rules for sensitive data

C. Use purpose to define the legal justification for data processing

D. Rely solely on data taxonomy to classify data for access control

Answer: (B)

Explicación

The correct application involves using purpose and data taxonomy together to determine appropriate access filtering rules, especially for sensitive data. This ensures data is used in line with its classification and the business objective, supporting compliance and responsible data management.

9. What is a key property of 'Data Subject Considerations' in data access control?

A. Classifying data based on sensitivity levels

B. Filtering data based on legal requirements

C. Defining the purpose for data use

D. Recognizing the individual to whom the data relates and incorporating their rights

Answer: (D)

Explicación

'Data Subject Considerations' involve recognizing the individual related to the data and ensuring their rights and privacy are protected during access decisions. This property is fundamental to responsible data governance and compliance with privacy laws.

10. What is Consent Filtering in the context of data access management?

A. A method of categorizing data types for access control

B. A system of encrypting sensitive data during transfer

C. A process of restricting data access based on the data subject’s consent and the purpose of use

D. A procedure for verifying the identity of data requesters

Answer: (C)

Explicación

Consent Filtering is the process that restricts data access based on the data subject’s explicit permission and the purpose of use, ensuring compliance with privacy regulations and preventing misuse of sensitive data.

11. Under which regulation is establishing a legal basis for data processing a mandatory requirement?

A. ISO 27001

B. HIPAA

C. CCPA

D. GDPR

Answer: (D)

Explicación

GDPR (General Data Protection Regulation) explicitly mandates that data controllers must establish a legal basis for processing personal data, making it a mandatory requirement for lawful data handling under this regulation.