Security Compliance

Exam objective 5.4: Summarize elements of effective security compliance.

This objective covers what it takes for an organization to comply with the laws, regulations, contracts, and internal policies that govern its security and privacy practices. It includes compliance-focused training (data handling, anti-money laundering and counter-terrorist financing, and anti-bribery), monitoring through attestations and acknowledgements, the consequences of non-compliance (reputational damage, financial penalties, legal action, contractual remedies, sanctions, and loss of license), the core privacy concepts that appear in modern data protection laws (the right to be forgotten, opt-in and opt-out consent, data correction, processing restrictions and prevention, controllers and processors, and data ownership), and legal compliance obligations such as legal holds, legal orders, and data retention requirements.

This is a "summarize" objective, which means you need to know what each element is and why it matters, and be able to recognize it from a description. You will not be asked to quote statutes, but the exam does expect you to connect concepts to real regulations. This chapter uses the EU General Data Protection Regulation (GDPR), the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA), the US Health Insurance Portability and Accountability Act (HIPAA), the Payment Card Industry Data Security Standard (PCI DSS), and Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) as examples.

What Compliance Means

Compliance is the state of conforming to rules imposed from outside the organization (laws, regulations, industry standards, and contracts) and from inside it (policies and standards). Security compliance specifically concerns the obligations that require an organization to protect information and systems in particular ways.

Compliance and security are related but not the same. An organization can pass an audit and still be breached, and a well-secured organization can still be non-compliant if it fails to document, report, or notify as required. Effective programs treat compliance as a floor, not a ceiling, and build further based on risk (Chapter 23).

Sources of compliance obligations fall into a few broad groups:

Source Nature Examples Enforced by

Laws and regulations

Mandatory, government-imposedGDPR, HIPAA, PIPEDA, CCPA/CPRA,

Sox, glba

Regulators, courts, attorneys general

Industry standards

Contractually required PCI DSS Card brands and acquiring banks via merchant agreements

Source Nature Examples Enforced by

Contracts Agreed obligations with customers and partners

Customer security addenda, data processing agreements

Courts, contract remedies

Internal policies

Self-imposed rules Acceptable use policy, data classification policy

Management, HR, internal audit

Note

PCI DSS is not a law. It is a standard maintained by the PCI Security Standards Council (founded by the major card brands) and enforced through contracts between merchants, acquiring banks, and card brands. A few US states reference it in statutes, but in general non-compliance leads to contractual consequences such as fines from the acquirer, higher transaction fees, or loss of the ability to accept cards.

Compliance Training

People are the most common point of compliance failure. A clerk who emails a spreadsheet of patient records to a personal account, a sales executive who pays a "facilitation fee" to a foreign official, or a teller who processes structured cash deposits without reporting them can expose the organization to serious penalties regardless of how good the technical controls are. Compliance training targets the specific behaviors that laws and regulations require. Chapter 27 covers general security awareness training; here the focus is on regulatory topics.

Data Handling

Data handling training teaches employees how to collect, label, store, transmit, share, retain, and dispose of data according to its classification and the laws that apply to it. Topics include:

• Recognizing regulated data types: personal data, protected health information (PHI), cardholder data, financial records, and confidential business information.
• Applying the data classification policy and labels correctly.
• Approved methods for sharing data, such as encrypted email or managed file transfer, and prohibited methods, such as personal email or unapproved cloud storage.
• Minimum necessary and need-to-know principles. HIPAA's Privacy Rule, for example, requires covered entities to make reasonable efforts to use and disclose only the minimum necessary PHI for a purpose.
• Clean desk, screen locking, and secure printing practices.
• Retention schedules and secure disposal.
• How to recognize and report a potential data breach, since several laws impose tight notification deadlines.

Data handling training is often role-based: staff who take card payments learn never to write down card numbers or store security codes, while developers learn how to handle production data in test environments.

Anti-Money Laundering and Counter-Terrorist Financing (AML/CTF)

Money laundering is the process of disguising the origins of illegally obtained money so it appears legitimate, typically through placement (introducing cash into the financial system), layering (moving it through transactions to obscure its trail), and integration (returning it to the economy as apparently clean funds). Terrorist financing is providing funds for terrorist activity; the money may come from legitimate sources, so the focus is on where it is going rather than where it came from. Financial institutions and many other businesses (money service businesses, casinos, and virtual currency providers, among others) are required by law to maintain AML/CTF programs. In the United States, the Bank Secrecy Act requires programs that include customer identification, ongoing monitoring, and filing of suspicious activity reports (SARs) and currency transaction reports with FinCEN. In Canada, the Proceeds of Crime (Money Laundering) and Terrorist Financing Act requires reporting entities to file reports with FINTRAC. The EU has its own series of AML directives and regulations.

AML/CTF training teaches employees to apply know your customer (KYC) procedures, recognize red flags such as structuring deposits to avoid reporting thresholds or unusual wire patterns, escalate suspicions internally, and avoid "tipping off" a customer that a report has been filed. Security teams intersect with AML/CTF through identity verification systems, fraud detection analytics, transaction monitoring, and protection of the sensitive reports themselves.

Anti-Bribery

Bribery is offering, giving, receiving, or soliciting something of value to improperly influence a decision. Anti-bribery laws include the US Foreign Corrupt Practices Act (FCPA), which prohibits bribing foreign officials and requires accurate books and records for issuers; the UK Bribery Act 2010, which also covers private-sector bribery and creates a corporate offense of failing to prevent bribery, with "adequate procedures" as a defense; and Canada's Corruption of Foreign Public Officials Act.

Anti-bribery training explains what counts as a bribe (cash, gifts, lavish hospitality, jobs for relatives, donations), gift and entertainment limits, how to handle requests for facilitation payments, how to perform due diligence on agents and intermediaries who act on the company's behalf, and how to report concerns. Because the UK Bribery Act treats training and adequate procedures as a defense, documented training is itself evidence of compliance. Anti-bribery also connects to the conflict-of-566 interest controls in vendor selection (Chapter 24): a procurement decision influenced by a kickback is both a compliance violation and a security risk.

Exam tip

Map the training topic to the scenario. Questions about recognizing suspicious financial transactions or verifying customer identity point to AML/CTF training. Questions about gifts, kickbacks, or payments to officials point to anti-bribery training. Questions about how to label, share, store, or dispose of sensitive data point to data handling training.

Compliance Monitoring

Training and policies say what should happen; monitoring confirms that it does. CompTIA highlights two mechanisms, along with the broader monitoring that supports them.

Attestations

An attestation is a formal declaration by a responsible party that something is true, typically that required controls are in place and operating, or that the organization complies with a requirement. Attestations put accountability on a named person or entity. Examples include:

• Management attestation of internal controls. Under the Sarbanes-Oxley Act (SOX), the CEO and CFO of US public companies must certify the accuracy of financial reports, and management must assess and report on internal control over financial reporting, which includes IT general controls such as access management and change management.
• PCI DSS Attestation of Compliance (AOC), signed by the merchant or service provider (and the assessor, where one is used) to declare compliance status after a Self-Assessment Questionnaire (SAQ) or a Report on Compliance (ROC) by a Qualified Security Assessor.
• Third-party attestation reports, such as SOC 2, in which an independent auditor attests to the design and effectiveness of controls (see Chapter 24).
• Internal control owner attestations, in which managers periodically certify that their team's access rights are appropriate (a key part of access recertification, Chapter 18) or that a control operated as designed.
• Employee attestations that they have complied with policies, such as an annual statement that they have not shared credentials or have disclosed any conflicts of interest.

Attestations are only as good as the evidence behind them. A manager who signs an access review without examining it creates a false record, and regulators treat false attestations seriously. Organizations should support attestations with evidence, automate data collection where possible, and spot-check through internal audit.

Acknowledgements

An acknowledgement is a record that a person has received, read, and understood a policy, training, or notice and agrees to abide by it. The most familiar example is an employee signing the acceptable use policy (AUP) during onboarding or clicking "I acknowledge" after completing annual training in a learning management system.

Acknowledgements matter for several reasons. They prove that the organization communicated its expectations, which supports disciplinary action or termination when someone violates a policy. They are evidence for auditors and regulators that training requirements were met.

• Mechanis
• m
• Who makes it What it asserts Example

Attestation A responsible party: management, control owner,

auditor, organization

That controls are in place or requirements are met

CFO certification under SOX; PCI DSS AOC; SOC 2 opinion

Acknowled

gement

An individual user or employee

That they received and understood a policy or training and will comply

Signing the AUP; confirming completion of data handling training

Memory aid

Attest = "I assert it is true and compliant." Acknowledge = "I know the rules and will follow them." Attestations are about the state of controls; acknowledgements are about awareness of obligations.

Consequences of Non-Compliance

Understanding consequences helps explain why organizations invest in compliance and how risk analysis (Chapter 23) estimates impact. CompTIA lists six categories, which often occur together.

Reputational Damage

Reputational damage is the loss of trust among customers, partners, investors, and the public. Breach headlines, regulatory enforcement announcements, and public lawsuits all erode confidence. Reputational harm is hard to quantify but frequently the most expensive consequence: customers leave, sales cycles lengthen, partners demand additional assurance, recruiting suffers, and stock prices drop. Some regulators deliberately publicize enforcement actions, and many breach notification laws require informing affected individuals directly, which makes incidents visible.

Financial

Financial consequences include regulatory fines and penalties, as well as the costs of remediation, forensic investigation, notification, credit monitoring, legal defense, and increased insurance premiums. Some examples of how penalties are structured:

• GDPR — administrative fines of up to EUR 20 million or 4 percent of total worldwide annual turnover, whichever is higher, for the most serious infringements, and up to EUR 10 million or 2 percent for others.
• HIPAA — tiered civil monetary penalties based on the level of culpability, from violations the entity did not know about up to willful neglect that is not corrected, with annual caps per violation category that are adjusted for inflation. Criminal penalties apply to knowingly obtaining or disclosing PHI in violation of the law.
• CCPA/CPRA — civil penalties assessed per violation, with higher amounts for intentional violations and violations involving the personal information of minors, enforced by the California Privacy Protection Agency and the California Attorney General. Consumers also have a private right of action for certain data breaches caused by a failure to maintain reasonable security.
• PIPEDA — knowingly failing to report a breach of security safeguards to the Privacy Commissioner, notify affected individuals, or keep required breach records is an offense punishable by fines of up to CAD 100,000.
• PCI DSS — non-compliance fines are imposed contractually by acquiring banks and card brands, and a breached merchant may also bear card reissuance and fraud costs.

Legal

Legal consequences include lawsuits from affected individuals (often class actions), shareholder suits against directors and officers, actions by attorneys general and regulators, consent decrees that impose years of mandatory audits and oversight, and in serious cases criminal prosecution of individuals.

Contractual

Contractual consequences arise when non-compliance breaches obligations in agreements with customers, partners, or vendors. Contracts may impose penalties, require indemnification of the other party's losses, allow the other party to terminate, or trigger audit rights.

Sanctions

Sanctions are penalties or restrictions imposed by governments, regulators, or professional bodies. The term is used in two related ways on the exam:

• Regulatory sanctions — enforcement measures such as orders to stop processing data, bans on certain activities, mandatory corrective action plans, or public censure. Under the GDPR, a supervisory authority can impose a temporary or permanent ban on processing, which may be more damaging than a fine.
• Economic and trade sanctions — government restrictions on doing business with specified countries, entities, or individuals, such as those administered by the US Office of Foreign Assets Control (OFAC). Organizations that process payments for, export technology to, or pay ransoms to sanctioned parties can face severe penalties. This is one reason organizations consult counsel before any ransomware payment.

Loss of License

Loss of license means a regulator revokes or suspends the authorization an organization or individual needs to operate. Banks need charters, insurers need state or provincial licenses, healthcare providers and pharmacies need licenses, and professionals such as accountants, lawyers, and physicians hold individual licenses. Serious or repeated compliance failures can lead to suspension or revocation, which can end a business outright. In the payment card world, the closest equivalent is losing the ability to process card payments, which for many merchants is fatal.

Real-world scenario

A regional pharmacy chain ignored repeated internal audit findings about unencrypted backups containing prescription records. When a backup drive was stolen, the chain faced HIPAA civil penalties and a multi-year corrective action plan (financial and sanctions), a class action from affected patients (legal), termination by a pharmacy benefits partner whose contract required encryption (contractual), and local news coverage that drove customers to competitors (reputational). The state board of pharmacy also opened an inquiry that could affect store licenses (loss of license). One control failure triggered every consequence category.

Privacy

Privacy laws give individuals rights over their personal data and impose obligations on organizations that collect and use it. Security professionals must understand these rights because many are implemented through technical controls: deleting data across systems and backups, honoring consent flags in databases, restricting processing, and tracking who holds data. Chapter 12 covers data types and protection techniques; this section covers rights and roles.

Right to Be Forgotten

The right to be forgotten, formally the right to erasure in Article 17 of the GDPR, allows individuals to request deletion of their personal data when, for example, it is no longer necessary for the purpose it was collected, they withdraw consent and there is no other legal basis, they object to processing and there are no overriding legitimate grounds, or the data was processed unlawfully. The right is not absolute. Organizations may retain data needed to comply with a legal obligation, to establish or defend legal claims, or for certain public interest purposes.

Other laws provide similar rights. The CCPA/CPRA gives California consumers the right to delete personal information a business collected from them, subject to exceptions. PIPEDA does not contain a GDPR-style erasure right in the same form, but it requires that personal information be kept only as long as necessary for the identified purposes and then destroyed, erased, or anonymized, and individuals may withdraw consent.

Implementing erasure is a real technical challenge: the organization must find the person's data across databases, logs, SaaS applications, and processors, delete or anonymize it, and ensure that backups containing it are not restored to active use before they expire. Good data inventory and data flow mapping make this feasible.

Opt-In and Opt-Out

Opt-in and opt-out describe how consent is obtained:

• Opt-in means the organization may not process the data for a purpose until the individual takes an affirmative action to agree, such as checking an unchecked box. The GDPR's standard for consent is opt-in: consent must be freely given, specific, informed, and unambiguous, given by a clear affirmative act, and as easy to withdraw as to give. Pre-ticked boxes and silence do not count.
• Opt-out means processing is allowed by default until the individual objects. The CCPA/CPRA largely follows an opt-out model for the sale or sharing of personal information, requiring a clear "Do Not Sell or Share My Personal Information" link and honoring opt-out preference signals, while requiring opt-in consent for selling or sharing the data of consumers under 16. US email marketing law (CAN-SPAM) is also an opt-out model.

PIPEDA requires meaningful consent and allows the form of consent to vary with the sensitivity of the information and the individual's reasonable expectations: express (opt-in) consent is generally expected for sensitive information, while implied consent may be acceptable for less sensitive uses.

Figure 25.1: Opt-in withholds processing until the individual agrees, while opt-out allows processing until the individual objects

Exam tip

Opt-in means "no until you say yes"; opt-out means "yes until you say no." When a question describes a default-unchecked consent box or an explicit affirmative choice, it is opt-in. When it describes processing that continues until the user clicks an unsubscribe or "do not sell" link, it is opt-out.

Data Correction

Data correction, called the right to rectification in Article 16 of the GDPR, gives individuals the right to have inaccurate personal data corrected and incomplete data completed. The CPRA added a right to correct to California law. HIPAA gives individuals the right to request amendment of their PHI in a designated record set; the covered entity may deny the request in certain circumstances (for example, if the record is accurate and complete) but must respond in writing and allow the individual to submit a statement of disagreement. PIPEDA's Individual Access principle lets individuals challenge the accuracy and completeness of their information and have it amended as appropriate.

Correction supports integrity, but organizations must verify the requester's identity so attackers cannot alter someone else's records.

Processing Restrictions

Processing restrictions limit how an organization may use personal data without necessarily deleting it. Under the GDPR's right to restriction of processing (Article 18), an individual can require the organization to store but not otherwise use their data in certain situations, such as while the accuracy of the data is being contested or when the individual needs the data kept for a legal claim but the organization no longer needs it. Restricted data is typically flagged or moved so that it is excluded from normal processing.

Processing restrictions also come from principles built into privacy laws: purpose limitation (data collected for one purpose may not be repurposed incompatibly), data minimization (collect only what is needed), and storage limitation. HIPAA gives individuals the right to request restrictions on certain uses and disclosures of their PHI; a covered entity generally need not agree, but must agree to a request not to disclose information to a health plan about services the individual paid for in full out of pocket. The CPRA gives consumers the right to limit the use and disclosure of sensitive personal information.

Processing Prevention

Processing prevention goes further: the individual stops processing altogether, or for a particular purpose. Under the GDPR's right to object (Article 21), an individual can object to processing based on legitimate interests or public tasks, and the organization must stop unless it demonstrates compelling legitimate grounds that override the individual's interests. An objection to direct marketing is absolute; the organization must stop processing for that purpose. Withdrawing consent similarly prevents further consent-based processing. The CCPA/CPRA right to opt out of sale or sharing is another form of processing prevention.

Right What the individual can require

GDPR example Other laws

Right to be forgotten

Delete my data Article 17, right to erasure CCPA/CPRA right to delete

Data correction

Fix my inaccurate data Article 16, right to rectification

CPRA right to correct; HIPAA amendment; PIPEDA accuracy challenge

Processing restriction

Keep my data but limit its

use

Article 18, right to restriction

CPRA limit use of sensitive data; HIPAA restriction requests

Processing prevention

Stop using my data (for a purpose)

Article 21, right to object; withdrawal of consent

CCPA/CPRA opt-out of sale or sharing

Opt-in / opt-outControl whether consent is assumed

Opt-in consent standard CCPA/CPRA opt-out model; PIPEDA express or implied consent

Controller vs. Processor

Privacy laws distinguish between organizations based on their role:

• A data controller determines the purposes and means of processing personal data — the "why" and "how." A retailer that collects customer data to fulfill orders and run its loyalty program is a controller. Controllers bear primary responsibility for compliance, including honoring data subject rights, establishing a lawful basis, and notifying regulators of breaches. Under the GDPR, controllers must report qualifying personal data breaches to the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of them.
• A data processor processes personal data on behalf of the controller, following the controller's documented instructions. A cloud email provider, a payroll service, or a marketing platform processing a company's customer list are processors. Under the GDPR, processors must have a written contract (a data processing agreement) with the controller, implement appropriate security, use sub-processors only with the controller's authorization, and notify the controller of breaches without undue delay.

If a processor starts deciding its own purposes for the data, such as using customer data to train its own products without authorization, it may become a controller for that processing and take on controller obligations. Other laws use parallel concepts: the CCPA/CPRA distinguishes businesses from service providers and contractors, and HIPAA distinguishes covered entities (health plans, healthcare clearinghouses, and healthcare providers that conduct certain electronic transactions) from business associates that handle PHI on their behalf under a business associate agreement (BAA). Under PIPEDA, an organization remains responsible for personal information it transfers to a third party for processing and must use contractual or other means to ensure comparable protection.

Figure 25.2: The controller decides why and how data is processed, directs processors by contract, and remains accountable for breach reporting

Do not assume the processor bears responsibility for compliance just because it holds the data. The controller remains accountable for choosing processors that provide sufficient guarantees and for ensuring they are bound by contract. This is the privacy-law version of the Chapter 24 principle that you cannot outsource accountability.

Ownership

Data ownership has two related meanings that the exam may test:

• Organizational ownership — within the organization, the data owner is the senior business person accountable for a data set: deciding its classification, who may access it, and how it is protected. Supporting roles include the data custodian (often IT, who implements controls such as backups and encryption), the data steward (who ensures data quality and proper use), and the data subject (the individual the data is about). Chapter 12 covers these roles in context.
• Individual rights over personal data — privacy laws reflect the idea that individuals retain rights over information about them even when an organization holds it. The organization may own the database, but the data subject can exercise rights of access, correction, deletion, and objection. Contracts with vendors should state clearly that the customer, not the vendor, owns its data and can retrieve it at the end of the relationship.

Real-world scenario

A Canadian e-commerce company uses a US-based email marketing platform to send newsletters to customers in Canada, California, and Germany. The company is the controller (the business under CCPA/CPRA); the platform is a processor (a service provider). A German customer asks to have her data deleted, a California customer clicks "Do Not Sell or Share My Personal Information," and a Canadian customer writes to say his address is wrong. The company handles an erasure request, an opt-out of sale or sharing, and a correction request, and must ensure each is carried through to the marketing platform under the terms of its data processing agreement.

Legal Compliance

The final group of concepts covers legal obligations that affect how long data is kept and when it must be preserved or produced.

Legal Hold

A legal hold (also called a litigation hold) is a directive, usually issued by the legal department, to preserve all data and records that may be relevant to pending or reasonably anticipated litigation, investigation, or audit. Once a hold is issued, normal retention and deletion schedules are suspended for the covered data. That means stopping automatic deletion of email, preserving relevant user mailboxes and devices when employees leave, retaining backup media that would otherwise be rotated, and preventing users from deleting relevant files.

Failing to preserve evidence after a duty to preserve arises is called spoliation, and courts can impose serious penalties, including fines, instructions to the jury that the missing evidence would have been unfavorable, or default judgments. IT and security teams implement legal holds through features such as mailbox litigation hold, retention locks in cloud storage, and imaging of endpoints. Holds must be documented, communicated to custodians (the employees who hold relevant data), and released when the matter ends so that normal retention resumes. Legal holds also connect to digital forensics and chain of custody (Chapter 21).

Figure 25.3: A legal hold suspends the normal retention schedule for covered data until the matter ends Legal Orders

Legal orders are formal demands from courts, law enforcement, or government agencies that compel an organization to take an action regarding data. Examples include:

• Subpoenas requiring production of documents or testimony.
• Search warrants authorizing law enforcement to search and seize data or devices.
• Court orders requiring preservation, production, or deletion of data, or prohibiting certain actions.
• Production orders and data requests under statutes that govern access to stored communications, which may come with nondisclosure (gag) orders preventing the organization from telling the affected user.

Organizations need a defined process: route orders to legal counsel, verify their authenticity (attackers have sent fake emergency data requests impersonating law enforcement), preserve the relevant data, produce exactly what is required and no more, and document every step. Cross-border orders can conflict with local privacy law, another reason geography matters in vendor selection (Chapter 24).

Data Retention Requirements

Data retention requirements specify how long certain records must be kept, and sometimes how soon they must be destroyed. They come from laws, regulations, contracts, and business needs. Examples:

• HIPAA requires covered entities and business associates to retain required Security Rule and Privacy Rule documentation (policies, procedures, risk analyses, and similar records) for six years from creation or last effective date. Medical record retention periods themselves are generally set by state law.
• PCI DSS requires that audit log history be retained for at least 12 months, with at least the most recent three months immediately available for analysis, and requires that cardholder data storage be kept to a minimum with defined retention limits. Sensitive authentication data, such as full magnetic stripe data and card verification codes, must not be stored after authorization.
• SOX and SEC rules require auditors to retain audit workpapers and related records for seven years.
• PIPEDA requires organizations to keep records of every breach of security safeguards involving personal information for 24 months, whether or not the breach was reportable.
• GDPR does not set fixed periods but imposes storage limitation: personal data must be kept in identifiable form no longer than necessary for the purposes for which it is processed. These requirements pull in opposite directions. Keeping data too briefly can violate retention laws and destroy evidence; keeping it too long violates privacy principles, increases breach impact, and increases e-discovery costs. A data retention policy and schedule (Chapter 22) resolves this tension by defining the retention period for each record type, the legal basis for it, the owner, and the disposal method, with legal holds overriding the schedule when necessary.

Concept What it does Overrides normal retention?

Example

Legal hold Preserves data relevant to litigation or investigation

Yes — suspends deletion Freeze mailboxes of employees

involved in a lawsuit

Legal order Compels a specific action, often production of data

May require preservation or disclosure

Subpoena for transaction records

Concept What it does Overrides normal retention?

Example

Data retention requireme

nt

Sets minimum or maximum time to keep records

Defines the normal schedule

Keep PCI DSS audit logs at least one year

Exam tip

If a question says normal deletion schedules must be suspended because of a lawsuit, the answer is legal hold. If it describes a subpoena or warrant demanding data, the answer is a legal order. If it describes how many years records must be kept, the answer is a data retention requirement.

Chapter Summary

• Compliance means conforming to laws, regulations, industry standards, contracts, and internal policies. It is a baseline for security, not a guarantee of it. PCI DSS is enforced contractually, not as law.
• Compliance training targets regulated behaviors: data handling (classify, share, retain, and dispose of data correctly), AML/CTF (KYC, recognizing and reporting suspicious transactions), and anti-bribery (FCPA, UK Bribery Act, gifts, facilitation payments).
• Compliance monitoring relies on attestations (a responsible party declares controls are in place, such as SOX certifications or a PCI DSS AOC) and acknowledgements (individuals confirm they received and understood policies or training).
• Consequences of non-compliance include reputational damage, financial penalties (GDPR up to 4 percent of global turnover), legal action, contractual remedies, sanctions (regulatory measures or trade restrictions), and loss of license.
• Privacy rights include the right to be forgotten (erasure), opt-in versus opt-out consent, data correction (rectification), processing restrictions, and processing prevention (objection, opt-out of sale or sharing).
• The controller decides why and how personal data is processed; the processor acts on the controller's instructions. Parallel roles: CCPA business/service provider; HIPAA covered entity/business associate.
• Ownership covers the internal data owner role and individuals' continuing rights over their personal data.
• Legal holds suspend deletion to preserve evidence; legal orders compel action; data retention requirements define how long records must or may be kept.

Key Terms

Compliance; General Data Protection Regulation (GDPR); California Consumer Privacy Act (CCPA); California Privacy Rights Act (CPRA); Health Insurance Portability and Accountability Act (HIPAA); Payment Card Industry Data Security Standard (PCI DSS); Personal Information Protection and Electronic Documents Act (PIPEDA); data handling training; anti-money laundering (AML); counter-terrorist financing (CTF); know your customer (KYC); suspicious activity report (SAR); anti-bribery; Foreign Corrupt Practices Act (FCPA); UK Bribery Act; attestation; Attestation of Compliance (AOC); acknowledgement; reputational damage; fines; contractual consequences; sanctions; loss of license; right to be forgotten; right to erasure; opt-in; opt-out; data correction; right to rectification; processing restriction; processing prevention; right to object; purpose limitation; data minimization; data controller; data processor; sub-processor; data processing agreement; covered entity; business associate; business associate agreement (BAA); data owner; data custodian; data steward; data subject; legal hold; spoliation; legal order; subpoena; data retention requirement; storage limitation.

Review Questions

• 1. A bank requires all tellers to complete annual training on identifying structured cash deposits, verifying customer identity, and escalating unusual wire transfers to the compliance officer. Which type of compliance training is this?

• A. Data handling
• B. Anti-bribery
• C. AML/CTF
• D. Privacy

• 2. During onboarding, each new employee must read the acceptable use policy and click a button confirming they have read and understood it and agree to comply. What does this confirmation represent?

• A. Attestation
• B. Acknowledgement
• C. Legal hold
• D. Processing restriction

• 3. A company's CFO signs a statement to regulators certifying that internal controls over financial reporting, including IT access controls, are effective. Which compliance monitoring mechanism is this?

• A. Acknowledgement
• B. Attestation
• C. Legal order
• D. Opt-in consent

• 4. A German customer asks an online retailer to delete all of her personal data because she no longer uses the service. Which privacy right is she exercising?

• A. Right to rectification
• B. Right to be forgotten
• C. Right to restriction of processing
• D. Opt-out of sale

• 5. A company is sued by a former business partner. The legal department instructs IT to stop the automatic 90-day deletion of email for all employees involved in the partnership. What is this instruction called?

• A. Data retention requirement
• B. Legal order
• C. Legal hold
• D. Processing prevention

• 6. A hospital uses a cloud-based transcription service that processes patient recordings on the hospital's behalf. Which TWO statements are correct? (Select TWO.)

• A. The hospital is a covered entity under HIPAA.
• B. The transcription service is a business associate and should sign a BAA.
• C. The transcription service becomes the data owner of the recordings.
• D. The hospital is no longer accountable for the PHI once it is sent to the service.
• E. HIPAA does not apply because the data is stored in the cloud.

• 7. A website shows a newsletter signup checkbox that is unchecked by default. Visitors receive marketing emails only if they check the box. Which consent model is used?

• A. Opt-out
• B. Opt-in
• C. Implied consent
• D. Processing restriction

• 8. A payroll SaaS provider processes employee data according to its customers' instructions. Under the GDPR, which role does the provider hold?

• A. Controller
• B. Data subject
• C. Processor
• D. Supervisory authority

• 9. Following a serious data protection violation, a regulator orders a company to stop processing customer data for marketing purposes until it remediates its practices. Which consequence category does this BEST represent?

• A. Reputational damage
• B. Sanctions
• C. Contractual
• D. Loss of license

• 10. A customer disputes the accuracy of the billing address a company holds. While the dispute is investigated, the customer asks the company to keep the data but not use it for any purpose. Which privacy right is the customer exercising?

• A. Processing restriction
• B. Right to be forgotten
• C. Data correction
• D. Opt-in

• 11. An e-commerce merchant asks how long it must keep audit logs for systems in its cardholder data environment. Which requirement applies, and what is the minimum?

• A. GDPR; 72 hours
• B. PCI DSS; 12 months, with three months immediately available
• C. HIPAA; six years
• D. PIPEDA; 24 months

• 12. A state insurance regulator revokes an insurer's authority to sell policies after years of unaddressed data protection violations. Which TWO consequences does this situation MOST directly illustrate? (Select TWO.)

• A. Loss of license
• B. Opt-out
• C. Reputational damage
• D. Legal hold
• E. Data correction

Answers and Explanations

• 1. C. Recognizing structured deposits, verifying customer identity (KYC), and escalating suspicious transactions are core elements of anti-money laundering and counter-terrorist financing training. Data handling training covers classifying, storing, sharing, and disposing of data. Anti-bribery training covers gifts, kickbacks, and payments to officials. Privacy is not a training category listed in this context and does not describe these behaviors.
• 2. B. An individual confirming receipt and understanding of a policy is an acknowledgement. An attestation is a formal declaration by a responsible party that controls are in place or requirements are met. A legal hold preserves data for litigation, and a processing restriction limits use of personal data.
• 3. B. A responsible executive formally certifying that controls are effective is an attestation, as required for public company executives under SOX. An acknowledgement confirms awareness of a policy, a legal order is a demand from a court or authority, and opt-in consent concerns personal data processing.
• 4. B. A request to delete personal data is the right to be forgotten (right to erasure, GDPR Article 17). Rectification corrects inaccurate data, restriction keeps data but limits its use, and opt-out of sale is a CCPA/CPRA concept about selling or sharing data rather than deleting it.
• 5. C. Suspending normal deletion to preserve data relevant to litigation is a legal hold. A data retention requirement sets the normal retention schedule. A legal order is a demand from a court or authority, such as a subpoena. Processing prevention is an individual's privacy right to stop processing.
• 6. A, B. A hospital that conducts standard electronic healthcare transactions is a covered entity, and a vendor that handles PHI on its behalf is a business associate that must sign a business associate agreement. The vendor does not become the data owner. The hospital remains accountable for protecting PHI. HIPAA applies regardless of where the data is stored.
• 7. B. Processing that occurs only after an affirmative action, such as checking an unchecked box, is opt-in. Opt-out would assume consent until the visitor declines. Implied consent infers agreement from conduct without an explicit action. A processing restriction limits use of data already held.
• 8. C. An organization that processes personal data on behalf of and according to the instructions of another organization is a processor. The customers are controllers because they determine the purposes and means. The employees are data subjects. A supervisory authority is the regulator.
• 9. B. A regulator-imposed ban or restriction on an activity is a sanction. Reputational damage may follow but is not what the order itself represents. Contractual consequences arise from breaches of agreements with other parties. Loss of license would revoke the organization's authority to operate rather than restrict one processing activity.
• 10. A. Keeping data while limiting its use, especially while accuracy is disputed, is the right to restriction of processing. The right to be forgotten would delete the data. Data correction would fix the address, which may follow the investigation but is not what the customer is requesting now. Opt-in concerns consent.
• 11. B. PCI DSS requires retaining audit log history for at least 12 months, with at least the most recent three months immediately available for analysis. The GDPR's 72-hour figure is the breach notification deadline to supervisory authorities, not a log retention period. Six years is HIPAA's documentation retention period. Twenty-four months is PIPEDA's requirement for keeping breach records.
• 12. A, C. Revocation of the authority to sell policies is a loss of license, and a public regulatory action of this kind inevitably damages the company's reputation. Opt-out and data correction are privacy rights, not consequences. A legal hold preserves data for litigation and is not a penalty.