Certified Information Systems Security Professional (CISSP) — Question 6

Which of the following would qualify as an exception to the "right to be forgotten" of the General Data Protection Regulation (GDPR)?

Answer options

• A. For the establishment, exercise, or defense of legal claims
• B. The personal data has been lawfully processed and collected
• C. For the reasons of private interest
• D. The personal data remains necessary to the purpose for which it was collected

Correct answer: A

Explanation

Option A is correct because the GDPR allows for exceptions to the right to be forgotten when it comes to legal claims. The other options, while they address aspects of data processing or necessity, do not specifically apply as exceptions under the GDPR framework.