ISO 31010:2019 Foundation Free Practice Test — 30 Questions

Question 1

DataStream Solutions, a cloud service provider, is seeking ISO 27018:2019 certification. A client, Ms. Anya Sharma, requests to transfer all of her Personally Identifiable Information (PII) stored with DataStream to a competing service provider. What is DataStream\'s MOST appropriate course of action under ISO 27018:2019?

Accepted Answer

Provide Ms. Sharma with her PII in a structured, commonly used, and machine-readable format, enabling her to easily transfer the data to the new service provider.

Question 2

\"CloudSecure Solutions,\" a rapidly growing SaaS provider based in the EU, is seeking to enhance its data protection practices and demonstrate compliance with the General Data Protection Regulation (GDPR). They are considering adopting ISO 27018:2019. As a consultant specializing in data protection and cloud security, you are asked to advise them on the relationship between ISO 27018:2019 and GDPR. Which of the following statements best describes the role of ISO 27018:2019 in achieving GDPR compliance for CloudSecure Solutions? Consider the nuances of legal requirements versus best practice frameworks.

Accepted Answer

ISO 27018:2019 provides a structured framework of controls and guidelines specifically tailored for protecting PII in cloud environments, which can significantly assist CloudSecure Solutions in demonstrating compliance with GDPR's requirements for appropriate technical and organizational measures, although it is not a substitute for addressing all GDPR legal requirements.

Question 3

Globex Enterprises, a multinational corporation, utilizes a cloud-based CRM system to manage customer relationships. Initially, customer data, including purchase history, contact information, and demographic details, was collected with the explicit purpose of providing personalized marketing campaigns and targeted promotions. Globex now intends to leverage this existing customer data to train a new AI-powered customer service chatbot, designed to automate responses to common inquiries and provide 24/7 support. The legal department raises concerns about potential violations of ISO 27018:2019 principles, specifically regarding data minimization and purpose limitation. Considering the principles outlined in ISO 27018:2019 and the potential implications of regulations like GDPR, what is the MOST appropriate course of action for Globex Enterprises to ensure compliance when repurposing customer data for AI training?

Accepted Answer

Evaluate the compatibility of AI training with the original purpose of data collection; if incompatible, obtain explicit consent or demonstrate a legitimate interest with full transparency.

Question 4

XYZ Corp, a multinational financial institution headquartered in Switzerland, utilizes a cloud-based CRM system provided by \"CloudSolutions Inc.\", a company based in the United States. XYZ Corp processes significant volumes of Personally Identifiable Information (PII) of its clients through this CRM system. CloudSolutions Inc. acts as a data processor under the terms of their agreement, adhering to ISO 27018:2019 standards for protecting PII in the cloud. A significant data breach occurs at CloudSolutions Inc., potentially exposing the PII of XYZ Corp\'s clients. Under ISO 27018:2019 guidelines and considering the roles of data controller (XYZ Corp) and data processor (CloudSolutions Inc.), what is CloudSolutions Inc.\'s MOST immediate and critical responsibility upon discovering the data breach?

Accepted Answer

Immediately notify XYZ Corp about the data breach, providing all available details and initiating collaborative incident response procedures.

Question 5

\"InnovTech Solutions\", a European e-commerce company, utilizes \"CloudPrime\", a US-based cloud service provider, for storing and processing customer data, including names, addresses, and purchase history. CloudPrime is certified under ISO 27018:2019. In October 2024, CloudPrime experiences a significant data breach affecting InnovTech\'s customer database. CloudPrime discovers the breach on October 10th but only informs InnovTech on October 25th, citing internal investigation delays. GDPR mandates that data breaches be reported to the relevant supervisory authority within 72 hours of discovery. InnovTech now faces potential GDPR penalties due to CloudPrime\'s delayed notification. Considering InnovTech\'s obligations as the data controller and CloudPrime\'s responsibilities under ISO 27018:2019, what is the MOST appropriate course of action for InnovTech Solutions?

Accepted Answer

Immediately notify the relevant supervisory authority of the data breach, documenting CloudPrime's delayed notification and initiating legal action against CloudPrime for breach of contract and failure to meet its obligations under ISO 27018:2019 and GDPR.

Question 6

\"Innovate Solutions,\" a multinational corporation, is adopting a multi-cloud strategy to host its customer relationship management (CRM) system, which contains extensive Personally Identifiable Information (PII) of its global customer base. They are utilizing Amazon Web Services (AWS) for data storage, Microsoft Azure for application hosting, and Google Cloud Platform (GCP) for analytics. Each provider claims to be ISO 27018:2019 compliant. Considering Innovate Solutions\' responsibility under ISO 27018:2019 in this multi-cloud environment, which of the following statements most accurately reflects their obligations regarding PII protection?

Accepted Answer

Innovate Solutions must conduct its own due diligence to verify that each cloud provider's security controls are effectively implemented and aligned with ISO 27018:2019, establish clear monitoring procedures, and maintain ultimate accountability for PII protection across all cloud environments.

Question 7

\"Globex Corp, a multinational advertising firm headquartered in New York, utilizes \'SkyHigh Cloud\', a global cloud service provider (CSP), for storing and processing personal data of EU citizens, primarily for targeted advertising campaigns. Their initial agreement, established in 2022, complied with the GDPR requirements at the time, focusing on data security and consent management. However, due to recent interpretations and stricter enforcement of GDPR\'s data residency clauses by the European Data Protection Board (EDPB), Globex Corp now mandates that all personal data of EU citizens must be processed and stored exclusively within the European Union. SkyHigh Cloud\'s existing infrastructure processes some of Globex\'s data in US-based data centers. Considering ISO 27018:2019 guidelines, what is the MOST appropriate course of action for SkyHigh Cloud to take in response to Globex Corp\'s updated data residency requirements?\"

Accepted Answer

Conduct a risk assessment to identify gaps in current controls, collaborate with Globex Corp to develop a remediation plan including potential data migration or geo-fencing, and update the ISMS documentation to reflect the new data residency requirements and implemented controls.

Question 8

\"Globex Corp, a multinational pharmaceutical company headquartered in Switzerland, is migrating its clinical trial data, including patient PII, to a public cloud provider based in the United States. The cloud provider is certified to ISO 27018:2019. Globex\'s legal team assures the CIO, Anya Sharma, that since the cloud provider is certified, Globex automatically complies with GDPR regarding the PII stored in the cloud. Anya, however, remains skeptical and consults with the Information Security Manager, Ben Carter. Ben is tasked with clarifying Globex\'s responsibilities concerning GDPR compliance in this cloud environment. Considering the shared responsibility model inherent in cloud computing and the requirements of ISO 27018:2019, which of the following statements most accurately reflects Globex\'s obligations concerning GDPR compliance for the clinical trial data stored with the ISO 27018:2019 certified cloud provider?\"

Accepted Answer

Globex remains ultimately responsible for GDPR compliance, even with the ISO 27018:2019 certification of the cloud provider, and its specific responsibilities depend on the cloud service model (IaaS, PaaS, or SaaS) being utilized.

Question 9

A global e-commerce company, \"InnovGlobal,\" utilizes a Software as a Service (SaaS) provider, \"CloudSecure,\" to store and process customer data, including Personally Identifiable Information (PII). InnovGlobal operates under the jurisdiction of GDPR. A customer, Ms. Anya Sharma, submits a formal request to InnovGlobal to rectify inaccurate information held about her. Considering the responsibilities outlined in ISO 27018:2019, what is CloudSecure\'s primary obligation in this scenario regarding Ms. Sharma\'s data rectification request? InnovGlobal is the data controller, and CloudSecure is the data processor. InnovGlobal has established a comprehensive data governance framework aligned with GDPR principles. CloudSecure\'s service agreement with InnovGlobal explicitly mentions compliance with ISO 27018:2019 and relevant data protection regulations. InnovGlobal has also implemented a robust data access control system.

Accepted Answer

To provide InnovGlobal with the necessary tools and functionalities within the SaaS platform to efficiently rectify Ms. Sharma's data, ensuring InnovGlobal can fulfill its GDPR obligations.

Question 10

\"Globex Enterprises,\" a multinational corporation headquartered in Switzerland, utilizes a globally distributed cloud infrastructure for its customer relationship management (CRM) system. This CRM system contains Personally Identifiable Information (PII) of customers residing in the EU, the United States, and Japan. The system is managed by a centralized IT department located in India, but customer service representatives in each region access and process data relevant to their respective jurisdictions. Globex also outsources its data storage to a third-party cloud provider based in Singapore. In defining the scope of their ISO 27018-compliant Information Security Management System (ISMS), which of the following considerations is MOST critical to ensure comprehensive coverage and compliance with relevant data protection regulations?

Accepted Answer

A holistic assessment encompassing all aspects of PII processing across the organization, including the global cloud infrastructure, regional customer service operations, the centralized IT department in India, the third-party data storage provider in Singapore, and consideration of the legal and regulatory requirements of the EU (GDPR), the US, and Japan.

Question 11

\"Globex Enterprises, a multinational corporation headquartered in Switzerland, is migrating its customer relationship management (CRM) system, which contains sensitive personal data of EU citizens, to a SaaS provider based in the United States. As the newly appointed Data Protection Officer, Anya Petrova is tasked with evaluating the SaaS provider\'s compliance with ISO 27018:2019 before the migration. Which of the following assessment areas should Anya prioritize to ensure comprehensive compliance and mitigate potential risks associated with transferring personal data to a third-party cloud service provider operating under a different legal jurisdiction, considering the requirements of GDPR and the specific guidance provided by ISO 27018:2019 regarding international data transfers and data subject rights?\"

Accepted Answer

"The SaaS provider's adherence to consent management principles, mechanisms for enabling data subject rights (access, rectification, erasure), incident response plan addressing PII breaches, and demonstration of GDPR compliance, including adequate contractual clauses for international data transfers."

Question 12

\"CloudSecure,\" a cloud service provider specializing in healthcare data storage, has implemented ISO 27018:2019. Initially, they collected patient data (PII) solely for the purpose of secure storage and retrieval as directed by the healthcare providers, their clients. They are now planning to offer a new \"Predictive Health Insights\" service that uses anonymized and aggregated patient data to identify potential health risks and trends. While the data is anonymized, CloudSecure still uses the originally collected PII to generate these insights. Under ISO 27018:2019, which of the following actions is MOST crucial for CloudSecure to ensure compliance and ethical data handling before launching the new service?

Accepted Answer

Conduct a thorough data protection impact assessment (DPIA) to evaluate the compatibility of the new service with the original purpose of data collection, and obtain explicit consent from data subjects if the new processing is not compatible, ensuring adherence to data minimization and purpose limitation principles.

Question 13

\"Innovate Solutions,\" a multinational corporation headquartered in Germany, is planning to migrate its customer relationship management (CRM) system, containing sensitive personal data of EU citizens, to a cloud-based Software as a Service (SaaS) provider located in the United States. Innovate Solutions aims to leverage the cost-effectiveness and scalability of cloud computing while ensuring compliance with the General Data Protection Regulation (GDPR) and ISO 27018:2019. As the Chief Information Security Officer (CISO) of Innovate Solutions, you are tasked with advising the board on the appropriate measures to take regarding data protection responsibilities in this cloud migration scenario. Considering the shared responsibility model in cloud computing and the requirements of GDPR and ISO 27018:2019, which of the following statements best describes Innovate Solutions\' ultimate responsibility for protecting personal data in this scenario?

Accepted Answer

Innovate Solutions retains ultimate responsibility for ensuring the protection of personal data under GDPR, requiring them to conduct due diligence on the SaaS provider, establish contractual agreements defining data protection responsibilities, and continuously monitor the provider's compliance with ISO 27018:2019.

Question 14

\"SecureData Solutions,\" a cloud service provider (CSP) based in Canada, is seeking to demonstrate its commitment to protecting Personally Identifiable Information (PII) in accordance with international best practices. What is the most comprehensive and effective approach for SecureData Solutions to achieve this goal, aligning with the core principles of ISO 27018:2019?

Accepted Answer

Establishing and maintaining a robust Information Security Management System (ISMS) that encompasses policies, procedures, and controls specifically tailored to PII protection in cloud environments, based on risk assessment and aligned with ISO 27001 and ISO 27018:2019 requirements.

Question 15

\"MediCorp,\" a healthcare organization, is implementing ISO 27018:2019 to protect the personal health information (PHI) of its patients. As part of the initial planning phase, MediCorp needs to establish a comprehensive understanding of its operational environment and the relevant data protection landscape. Which of the following actions is MOST critical for MediCorp to undertake to effectively establish the context of the organization as it relates to ISO 27018:2019 compliance and data protection?

Accepted Answer

Conduct a thorough analysis of all applicable legal, regulatory, and contractual requirements related to data protection, identify all relevant stakeholders and their expectations regarding PHI security, and define the scope of the ISMS to encompass all systems and processes that handle PHI.

Question 16

\"DataGuard Inc.,\" a healthcare provider certified under ISO 27018:2019, stores patient records containing sensitive PII in a cloud-based electronic health record (EHR) system. To enhance the security of this data and comply with ISO 27018:2019 requirements, which of the following technical controls should DataGuard Inc. prioritize implementing to prevent unauthorized access to patient PII in the cloud?

Accepted Answer

Implementing multi-factor authentication (MFA) for all users accessing the EHR system.

Question 17

\"InnovateCloud,\" a SaaS provider based in Switzerland, offers a cloud-based HR management system to global corporations. \"SecureData Solutions,\" located in India, is subcontracted by InnovateCloud to handle the data backup and disaster recovery services, including the storage of employee PII. InnovateCloud is certified under ISO 27018:2019. A significant data breach occurs at SecureData Solutions due to inadequate security protocols, exposing the PII of thousands of employees. Under ISO 27018:2019, which of the following entities bears the ultimate responsibility for ensuring that SecureData Solutions adheres to the principles and controls outlined in the standard and applicable data protection regulations such as GDPR? Consider the obligations of both entities regarding data protection and compliance in this cloud service provider/subcontractor relationship.

Accepted Answer

InnovateCloud, as the primary cloud service provider, retains ultimate responsibility for ensuring SecureData Solutions adheres to ISO 27018:2019 and relevant data protection regulations.

Question 18

\"DataSecure Cloud Solutions\" (DSCS), a cloud service provider based in the EU, offers Infrastructure as a Service (IaaS) to global clients. DSCS subcontracts its data center physical security and environmental controls to \"SecureBase Facilities,\" a company located outside the EU. A recent audit reveals that SecureBase Facilities has weaker physical access controls and environmental monitoring systems than DSCS\'s internal standards, potentially impacting the confidentiality and availability of PII stored in their data centers. Under ISO 27018:2019, what is DSCS\'s primary responsibility regarding this situation, considering the requirements of GDPR and the protection of PII?

Accepted Answer

DSCS remains ultimately responsible for ensuring that SecureBase Facilities meets the security requirements outlined in ISO 27018:2019 and GDPR, including implementing enhanced physical access controls and environmental monitoring, regardless of SecureBase Facilities' location.

Question 19

OmniCorp, a multinational corporation headquartered in Switzerland, is migrating its customer relationship management (CRM) system, which contains a substantial amount of Personally Identifiable Information (PII) of EU citizens, to a public cloud Infrastructure as a Service (IaaS) provider based in the United States. OmniCorp is seeking ISO 27018:2019 certification to demonstrate its commitment to protecting PII in the cloud. As part of the migration, OmniCorp signs a detailed Service Level Agreement (SLA) with the IaaS provider that outlines the provider\'s security responsibilities, including physical security of data centers, network security, and system availability. Given this scenario and considering the shared responsibility model inherent in cloud computing, which of the following statements best describes OmniCorp\'s responsibilities regarding the security of PII within the cloud environment?

Accepted Answer

OmniCorp retains responsibility for securing its data and applications within the cloud environment, including access control, data encryption, and compliance with applicable data protection regulations.

Question 20

DataEthix Solutions, a cloud-based data mining company, is implementing ISO 27018:2019. The company collects and analyzes large amounts of Personally Identifiable Information (PII) from various sources to provide targeted advertising services to its clients. The company\'s business model relies on using sophisticated algorithms to predict consumer behavior and preferences. However, the company\'s algorithms have been found to perpetuate biases and discriminate against certain groups of people. Furthermore, the company does not have a formal process for assessing the ethical implications of its data mining activities or for ensuring that its algorithms are fair and unbiased. Considering the requirements of ISO 27018:2019, what is the MOST appropriate course of action for DataEthix Solutions to take to address the ethical considerations of its data use?

Accepted Answer

Establish a formal process for assessing the ethical implications of its data mining activities, implement measures to ensure that its algorithms are fair and unbiased, provide employees with training on the ethical considerations of data use, and be transparent about its data practices with data subjects, while also establishing a mechanism for data subjects to report concerns or violations of ethical principles.

Question 21

\"CloudAssure,\" a data security firm undergoing ISO 27018:2019 implementation, identifies a potential vulnerability in its cloud storage system that could expose Personally Identifiable Information (PII). After assessing the risk, they determine the potential impact to be high (significant financial loss and reputational damage) and the likelihood of occurrence to be medium. Which of the following risk treatment options would be MOST appropriate for CloudAssure to consider in this scenario, aligning with ISO 27018:2019 principles? Assume CloudAssure has a moderate risk appetite.

Accepted Answer

Risk mitigation: Implementing enhanced security controls, such as multi-factor authentication and intrusion detection systems, to reduce the likelihood of the vulnerability being exploited and the potential impact of a data breach.

Question 22

\"Globex Cloud Solutions\" is an organization offering cloud-based HR management software to multinational corporations, processing sensitive employee data including PII. \"Stellar Corp,\" a client of Globex, is headquartered in the EU and subject to GDPR. A former employee of Stellar Corp, Anika Schmidt, exercises her right to be forgotten under GDPR, requesting the complete deletion of her personal data from Stellar Corp\'s HR records hosted on Globex Cloud Solutions. Globex Cloud Solutions must demonstrate compliance with ISO 27018:2019. What comprehensive actions should Globex Cloud Solutions undertake to adhere to ISO 27018:2019 and fulfill Anika Schmidt\'s request, while also considering the implications for Stellar Corp\'s overall data management and regulatory obligations?

Accepted Answer

Implement a process to securely and verifiably erase Anika Schmidt's data from all primary storage locations, backups, archives, and any other data retention systems within Globex Cloud Solutions' infrastructure, providing Stellar Corp with documented evidence of the complete deletion and ensuring that the deletion process aligns with GDPR requirements and does not compromise the integrity of Stellar Corp's HR system.

Question 23

\"Globex Innovations,\" a multinational corporation specializing in cloud-based human resources software, is expanding its operations into the European Union. To ensure compliance with GDPR and maintain customer trust, the Chief Information Security Officer (CISO), Anya Sharma, is tasked with implementing ISO 27018:2019. Globex Innovations already holds ISO 27001 certification for its overall Information Security Management System (ISMS). Anya is considering various approaches to implement ISO 27018. Which of the following strategies would best align with the intent and application of ISO 27018:2019, considering its relationship with ISO 27001 and the need to protect Personally Identifiable Information (PII) within the cloud environment?

Accepted Answer

Integrate ISO 27018 controls and guidelines into the existing ISO 27001 framework to address PII protection in the cloud environment.

Question 24

\"Globex Corporation, a multinational pharmaceutical company, utilizes a cloud-based Customer Relationship Management (CRM) system delivered via a Software as a Service (SaaS) model. This CRM system contains extensive Personally Identifiable Information (PII) of patients participating in clinical trials across multiple countries, including sensitive health data governed by GDPR and HIPAA. Globex is implementing ISO 27018:2019 to ensure adequate protection of this PII. Given the SaaS deployment model, which statement BEST describes Globex\'s accountability for the security and privacy of patient data stored within the CRM system, considering the principles outlined in ISO 27018:2019 and relevant data protection regulations?\"

Accepted Answer

Globex retains ultimate accountability for the security and privacy of patient data, even though the CRM system is managed by a third-party SaaS provider, and must implement controls to ensure the provider adheres to data protection requirements.

Question 25

\"Stellar Solutions,\" a software development company, is seeking ISO 27018:2019 certification for its cloud-based project management platform, which stores client data, including contact information and project specifications. To effectively define the \"context of the organization\" as required by ISO 27018:2019, \"Stellar Solutions\" must consider which of the following factors as the *most* comprehensive and critical element in their analysis?

Accepted Answer

A detailed analysis of the company's internal organizational structure, including departmental responsibilities and reporting lines, to ensure clear accountability for data protection.

Question 26

\"Globex Cloud Solutions,\" a cloud service provider certified under ISO 27018:2019, contracts with \"SecureData Analytics\" to perform data analytics on the PII of Globex Cloud Solutions\' customers. SecureData Analytics is not ISO 27018:2019 certified. Under ISO 27018:2019, what are Globex Cloud Solutions\' primary responsibilities regarding the protection of PII processed by SecureData Analytics? Consider the legal and contractual obligations, data subject rights, and the overall accountability framework within the cloud environment. Specifically, how should Globex Cloud Solutions ensure compliance with ISO 27018:2019 when using a non-certified subcontractor for PII processing, and what measures must they implement to maintain the required level of data protection? This includes defining roles and responsibilities, ensuring data security controls, and monitoring compliance to safeguard PII.

Accepted Answer

Globex Cloud Solutions retains full responsibility for the protection of PII processed by SecureData Analytics, ensuring SecureData Analytics implements and maintains appropriate security controls as per ISO 27018:2019, including conducting due diligence, monitoring compliance, and addressing any security incidents.

Question 27

Global Retail Corp, a multinational e-commerce company, is expanding its operations into several new countries and is committed to complying with ISO 27018:2019 to protect the Personally Identifiable Information (PII) of its customers. As part of its compliance efforts, the company\'s legal counsel, Ingrid Schmidt, is tasked with ensuring that the company\'s data protection practices align with the relevant legal and regulatory frameworks in each country. Which of the following actions is MOST critical for Ingrid to undertake in order to ensure Global Retail Corp\'s compliance with ISO 27018:2019 regarding the legal and regulatory framework?

Accepted Answer

Identifying and complying with all applicable data protection laws and regulations in each country where Global Retail Corp operates, including GDPR, CCPA, and other national or regional laws.

Question 28

MediCorp, a multinational pharmaceutical company, utilizes a Software as a Service (SaaS) provider, CloudRx, to manage its clinical trial data, including Personally Identifiable Information (PII) of trial participants, governed by GDPR. MediCorp acts as the data controller, and CloudRx acts as the data processor. During a routine audit, it\'s discovered that CloudRx\'s system automatically captures and stores the IP addresses and device IDs of all users accessing the clinical trial data, even though this information is not required for the core functionality of the clinical trial management system as defined by MediCorp. Furthermore, CloudRx\'s standard service agreement includes a clause stating they retain all data, including PII, for a period of seven years, irrespective of MediCorp\'s data retention policies. Considering the principles of ISO 27018:2019 and GDPR, which of the following actions by CloudRx represents the most significant violation of these standards?

Accepted Answer

CloudRx's automatic capture and storage of IP addresses and device IDs of users, as this contravenes the principle of data minimization by collecting unnecessary PII.

Question 29

\"Innovate Solutions Inc.\", a multinational corporation headquartered in the European Union, is planning to migrate its customer relationship management (CRM) system, which contains sensitive personal data of EU citizens, to a Software as a Service (SaaS) provider based in the United States. As the designated Data Protection Officer (DPO) for \"Innovate Solutions Inc.\", you are tasked with assessing the SaaS provider\'s compliance with data protection requirements under ISO 27018:2019. The SaaS provider possesses a general ISO 27001 certification. Which of the following assessment approaches would be the MOST effective in ensuring adequate protection of personal data under ISO 27018:2019, considering the requirements of GDPR and the specific risks associated with cloud-based PII processing?

Accepted Answer

Conduct a thorough review of the SaaS provider's data processing agreement (DPA), focusing on clauses related to PII protection, data subject rights, incident response, and compliance with GDPR, supplemented by an audit of their implementation of specific ISO 27018 controls related to transparency, consent, control, and communication regarding PII processing.

Question 30

\"Globex Cloud Solutions\" (GCS), a Cloud Service Provider (CSP) certified under ISO 27018:2019, experiences a data breach affecting the Personally Identifiable Information (PII) of its client \"OmniCorp,\" a multinational corporation subject to GDPR. The data processing agreement between GCS and OmniCorp stipulates a 48-hour breach notification period. GCS discovers the breach on Monday at 9:00 AM GMT but believes it can resolve the issue internally without notifying OmniCorp, aiming to avoid reputational damage. By Wednesday at 11:00 AM GMT, GCS realizes the breach is more severe than initially assessed and immediately notifies OmniCorp. Considering the principles of ISO 27018:2019 and its interplay with GDPR, what is the PRIMARY compliance issue GCS faces, and what immediate action should OmniCorp prioritize?

Accepted Answer

GCS violated the contractual obligation outlined in the data processing agreement regarding breach notification timelines, and OmniCorp should immediately assess the potential impact on data subjects and report the breach to the relevant Data Protection Authority (DPA) within GDPR's 72-hour timeframe, starting from when OmniCorp was notified.

ISO 31010:2019 Foundation Free Practice Test — 30 Questions

A lot more is already mapped out

About the ISO 31010:2019 Foundation Certification