I85PREP
⌘ K
CISEC-IT study materials
CISEC-IT study resources

CISEC-IT: Regulatory Compliance, Privacy, and Legal Obligations

CISEC-IT · Work through your exam, one topic at a time.

All guide sections

Regulatory Compliance, Privacy, and Legal Obligations

Regulatory Compliance, Privacy, and Legal Obligations

This domain tests whether you can translate legal obligation into program requirements and, under time pressure, make defensible notification decisions. Questions commonly involve controller/processor roles, lawful basis, cross-border transfer, breach clocks, and retention.

Core obligations

  • GDPR: lawful basis for processing, purpose limitation, data minimisation, records of processing, DPIAs for high-risk processing, and a 72-hour regulator notification from awareness where there is a risk to rights and freedoms.
  • CCPA/CPRA: consumer rights to know, delete, correct, and opt out of sale/sharing, with cure periods and service-provider contract terms.
  • HIPAA Security Rule for ePHI; PCI DSS for cardholder data (v4.0 emphasises targeted risk analyses and continuous compliance); SOX IT general controls for financial systems.
  • SEC rules require disclosure of material cybersecurity incidents on Form 8-K Item 1.05 generally within four business days of a materiality determination.
  • Cross-border transfers rely on adequacy decisions, standard contractual clauses, or binding corporate rules. NIS2 and DORA add sector resilience and ICT third-party obligations in the EU.

Roles and artifacts

Controller determines purpose and means; processor acts on instruction. Contracts, records of processing, retention schedules, and legal hold procedures are the evidence auditors and regulators request first.

Worked example

A laptop holding customer records is stolen. It is encrypted with AES-256 and keys are held in a managed HSM, not on the device. Assessment: the data is unintelligible without keys held elsewhere, so risk to rights and freedoms is unlikely, and GDPR notification is not required. Action: document the risk assessment, confirm key compromise is impossible, log the asset and the decision, and still notify per any stricter sector or US state rule. Reasoning: encryption changes the risk, not the obligation to assess and record; the decision must be evidence-based, not assumed.

Traps that cost marks

  • Asserting "we are encrypted, so no obligations apply" without documenting the assessment.
  • Mixing controller and processor duties, especially processor breach-notification-to-controller clauses.
  • Confusing regulator notification deadlines with individual notification deadlines.
  • Forgetting overlapping US state breach laws when a single EU rule is analysed.
  • Treating privacy as purely an IT problem rather than a business process and legal requirement.