Security+
CompTIA Security+ SY0-801 / All lessons / Domain 5.0: Security Program Management and Oversight
5Domain 5.0: Security Program Management and Oversight
Security+ topic 5.4

Compliance and Privacy

Compliance means following laws, regulations, contracts and internal policies. Organizations monitor their own compliance and report it internally and externally. Failing can mean fines, sanctions, loss of a license, or reputational damage. Privacy laws such as the GDPR protect personal data. Key ideas include the data subject (the person the data is about), the right to be forgotten, data inventory and retention, and attestations from leaders that controls are in place. Payment card data must follow PCI DSS, and health data in the United States follows HIPAA.

Compliance and Privacy vocabulary

  • Compliance: Meeting the requirements of laws, regulations, contracts, and policies.
  • Data subject: The person whom personal data is about.
  • Right to be forgotten: A person's right under laws such as the GDPR to have their personal data deleted.
  • Attestation: A formal statement that controls are in place and working.

Exam-style practice questions

Try each one, then open the answer. To save your progress, take this quiz in the interactive course.

1. A customer asks an online store to delete all of the personal data it holds about them. Which of the following rights is the customer using?

  1. (A) Right to be forgotten
  2. (B) Right to audit
  3. (C) Non-repudiation
  4. (D) Data sovereignty
Show answer

(A) Right to be forgotten Under laws like the GDPR, people can ask to have their data erased.

2. A merchant that stores credit card numbers must follow which of the following?

  1. (A) PCI DSS
  2. (B) HIPAA
  3. (C) SCAP
  4. (D) OCSP
Show answer

(A) PCI DSS PCI DSS covers payment card data.

3. In privacy law, what is the person whose personal data is collected called?

  1. (A) The data subject
  2. (B) The data processor
  3. (C) The data custodian
  4. (D) The data controller
Show answer

(A) The data subject The data subject is the person the data is about.

4. Which of the following is a likely consequence of failing a compliance requirement?

  1. (A) Fines and reputational damage
  2. (B) Faster network speeds
  3. (C) Automatic patching
  4. (D) Fewer phishing emails
Show answer

(A) Fines and reputational damage Non-compliance can bring fines, sanctions, and loss of trust.

Open 5.4 in the interactive course