Certified Information Privacy Professional – Europe (CIPP/E) — Question 148

A company is located in a country NOT considered by the European Union (EU) to have an adequate level of data protection. Which of the following is an obligation of the company if it imports personal data from another organization in the European Economic Area (EEA) under standard contractual clauses?

Answer options

• A. Submit the contract to its own government authority.
• B. Ensure that notice is given to and consent is obtained from data subjects.
• C. Supply any information requested by a data protection authority (DPA) within 30 days.
• D. Ensure that local laws do not impede the company from meeting its contractual obligations.

Correct answer: D

Explanation

The correct answer is D because the company must ensure that local laws do not hinder its ability to comply with the contractual obligations outlined in the standard contractual clauses. Option A is incorrect as there is no requirement to submit the contract to a government authority. Option B is not mandatory for the importing company in this context, and option C is unrelated to the specific obligations under standard contractual clauses.