Get the Preplance app for a seamless learning experience. Practice offline, get daily streaks, and stay ahead with real-time interview updates.
Get it on
Google Play
4.9/5 Rating on Store
Risk & Compliance · Question Set
Compliance interview questions for placements and exams.
Questions
14
Included in this set
Subject
Risk & Compliance
Explore more sets
Difficulty
Mixed
Level of this set
Go through each question and its explanation. Use this set as a focused practice pack for Risk & Compliance .
The GDPR protects how organizations collect, process, and store personal data of individuals in the EU. It emphasizes consent, transparency, and accountability. It gives people control over their data and requires organizations to justify every use of personal information.
For complete preparation, combine this set with full subject-wise practice for Risk & Compliance . You can also explore other subjects and sets from the links below.
HIPAA is built around the Privacy, Security, and Breach Notification Rules. The Privacy Rule protects patient data access, the Security Rule focuses on technical safeguards, and the Breach Notification Rule ensures prompt reporting. There is no formal 'Data Retention Rule' under HIPAA.
PCI DSS requires strong encryption to protect cardholder data at rest and in transit. Other requirements include maintaining firewalls, enforcing access control, and monitoring all network activity to prevent unauthorized access to payment information.
The Sarbanes–Oxley Act requires companies to implement strong internal controls that safeguard financial data and prevent fraud. These controls ensure accuracy, transparency, and accountability in all financial statements and reports.
The CCPA gives consumers the right to know what data is collected about them, request deletion, and prevent its sale to third parties. It enhances transparency and control for individuals regarding how their personal data is monetized or shared.
A compliance gap assessment is an internal review that compares current practices against the requirements of a specific regulation or framework. It identifies where controls or policies are missing or ineffective. Addressing these gaps early helps prevent legal penalties and improves overall security posture.
Data subject rights are legal privileges granted to individuals regarding their personal data. They include the right to access, correct, delete, restrict processing, and transfer their data. These rights empower people to control how organizations handle their personal information and ensure accountability.
Global privacy frameworks share common principles: lawfulness, fairness, transparency, purpose limitation, data minimization, accuracy, storage limitation, and integrity. These principles ensure that personal information is processed responsibly, securely, and only for legitimate purposes.
Accurate record-keeping demonstrates that policies and controls are implemented effectively. It includes maintaining logs, audit trails, and data processing records. These documents serve as evidence during audits and investigations, proving compliance with laws and internal policies.
Organizations must ensure vendors meet the same compliance and security standards they follow. This involves conducting due diligence, signing data protection agreements, and regularly auditing vendor practices. Shared responsibility must be clearly defined to avoid compliance failures through external partners.
A data retention policy defines how long different types of data are kept and when they are securely deleted. It ensures that data is stored only as long as necessary for legal, operational, or business reasons. This practice reduces exposure and supports compliance with privacy and industry regulations.
The DPDP Act establishes principles for handling personal data digitally in India. It requires organizations to obtain user consent, process data only for specific purposes, and maintain security measures. It also introduces the concept of data fiduciaries and user rights like correction and erasure.
A compliance audit checks whether an organization follows applicable laws, standards, and internal policies. It reviews documentation, technical controls, and evidence to ensure that all obligations are met and controls are functioning effectively.
Most privacy laws, including GDPR and HIPAA, require organizations to report data breaches within a specific time window, often 72 hours. The goal is to minimize harm by allowing individuals to take protective action and ensuring regulatory oversight.