Compliance Quiz: GDPR, HIPAA & PCI DSS Decoded

1. HIPAA's Privacy Rule governs the use and disclosure of which information?

All business records

Protected health information

Public government data

Employee payroll data

2. HIPAA requires organizations to conduct a Security Risk Analysis to identify vulnerabilities. How often should this be updated?

Every 5 years

Never

Periodically and when operations change

Only once at implementation

3. Under GDPR, a Data Protection Officer (DPO) is mandatory for which organizations?

All small businesses

Public authorities and large-scale data processors

Only retail companies

Never required

4. PCI DSS Requirement 6 focuses on secure development. Organizations must implement which practice?

Ad-hoc coding with no reviews

Secure code development and change management

No testing before deployment

Development without security standards

5. HIPAA's Breach Notification Rule applies to breaches of unsecured PHI. What does PHI stand for?

Personal Health Information

Protected Health Information

Public Health Information

Private Healthcare Industry

6. Which of the following is NOT a core principle of GDPR?

Lawfulness and fairness

Data minimization

Unlimited data retention

Purpose limitation

7. PCI DSS requires annual security assessments and penetration testing. Who should conduct these tests?

Untrained staff members

Qualified security assessors

Marketing department

No testing is required

8. HIPAA requires a Breach Notification Rule notification to affected individuals if a breach involves how many records?

Any number of records

At least 10 records

At least 100 records

At least 500 records

9. Under GDPR, individuals have the right to request deletion of personal data. What is this right called?

Right to access

Right to be forgotten

Right to rectification

Right to portability

10. PCI DSS requires organizations to maintain firewall configuration documentation and implement which security measure?

No firewalls needed

Firewalls with documented rules

Manual firewall management only

Firewalls for external networks only

11. Which regulation primarily protects personal data of EU residents?

HIPAA

GDPR

PCI DSS

FISMA

12. What is a Data Protection Impact Assessment (DPIA) required for under GDPR?

All data processing activities

High-risk processing activities

Only financial transactions

Never required

13. PCI DSS applies to organizations that handle which payment methods?

Cash only

Credit and debit cards

Cryptocurrencies only

Bank transfers only

14. HIPAA requires a breach notification within how many days?

10 days

30 days

60 days

90 days

15. Which principle is central to GDPR compliance?

Data minimization and consent

Profit maximization

Unrestricted data sharing

No audit requirements

16. PCI DSS requires a minimum password length of how many characters?

6 characters

8 characters

10 characters

12 characters

17. HIPAA's Security Rule requires encryption of which data?

All organizational data

Protected health information at rest and in transit

Financial records only

Employee personal information

18. What is the maximum fine for a GDPR violation?

€10 million

€20 million

€50,000

Up to 4% of global revenue

19. PCI DSS is designed to protect which type of data?

Medical records

Educational records

Payment card information

Biometric data

20. HIPAA applies to which type of organizations?

Retail businesses only

Healthcare providers, insurers, and clearinghouses

Financial institutions only

Technology vendors only