As a privacy assessor, what would most likely be the first artifact you would ask for while assessing an organization which claims that it has implemented a privacy program?

• A.Privacy risk management framework
• B.Records of privacy specific training imparted to the employees handling personal information
• C.Personal information management policy
• D.Records of deployed privacy notices and statements

Comment: *

Name: *

Email: *

Verification: *

Which of the following statements is true in respect of the India specific government projects such as
Aadhaar, National Population Register (NPR), etc. that can have privacy implications?

• A.Proper and adequate notification is not provided to data subjects before and during the collection of
  their personal information
• B.Citizens are being given the choice to opt out from submitting their biometric details and are allowed to
  complete the environment without submitting their biometrics
• C.Collection of biometrics in India is a statutory requirement
• D.Data subjects are not limited in their ability to exercise control over the ways their personal information
  is being used, once it has been shared by them as part of the projects

Comment: *

Name: *

Email: *

Verification: *

BS 10012 is a British standard used to establish ___________.

• A.Privacy reference architecture
• B.Privacy by design framework
• C.Personal information management system
• D.Privacy technology architecture

Comment: *

Name: *

Email: *

Verification: *

A company collects personal information about its employees and requests them to provide accurate information in order to avail benefits such as life insurance and medical insurance. Employees of the company have raised concerns about use of their personal information. Due to the concerns, the company has decided to create a privacy policy.
What all should the company include in its privacy policy to address the raised concerns?

• A.The purpose of collection of personal data
• B.The principle of presumed consent for data disclosure to avail benefits
• C.Information about how personal information is processed and used, specifically
• D.Contact details of Law Enforcement Agencies (LEA) to whom information is disclosed

Comment: *

Name: *

Email: *

Verification: *

XYZ & Co., an Indian hospital specialized in dealing with cancer treatment has organized a free health
checkup camp for women in a specific district, after seeking due permission from competent authorities.
During the camp the hospital staffs will be feeding the medical records of these women into the computer
connected to hospital network system. Does the said hospital need to notify its privacy policy to the women
attending the camp and seek their consent regarding the collection and processing of such information?

• A.Yes, in the any language as per the wishes of said hospital
• B.No, since the law does not require the same in this case
• C.No, since it is a free checkup camp for their welfare
• D.Yes, in the language such women would understand

Comment: *

Name: *

Email: *

Verification: *