Company A collects and stores information from people X & Y on behalf of company B. Which of the following statements are true?

• A.A is the data controller since it collects data directly from X & Y
• B.B is the data controller while A is the sub processor as B has outsourced the data collection and processing to A
• C.B is the data controller that uses A as data processor to collect and process data of data subjects X and Y
• D.Both A & B are data controllers since both need to maintain highest principles of data protection

Comment: *

Name: *

Email: *

Verification: *

One of the main objectives of 'Do Not Track' technology is to

• A.Opt out from the web based analytics services, advertising networks and social platforms
• B.Opt out from monitoring and surveillance programs of governments, intelligence and Law Enforcement Agencies
• C.Opt out from call back services by e-commerce companies
• D.None of the above

Comment: *

Name: *

Email: *

Verification: *

Which of the following privacy principle deals with informed consent of the data subject before sharing the
personal information (of the data subject) to third parties for processing?

• A.Purpose limitation
• B.Accountability
• C.Collection limitation
• D.Disclosure of information

Comment: *

Name: *

Email: *

Verification: *

XYZ Inc of USA has setup a captive back office operations center in India. The captive is registered as a separate legal entity by the name XYZ India Private Limited and provides services only to XYZ Inc by catering its technology support needs. During the process of providing services, the Indian entity does not receive any customer information of the XYZ Inc. However, information such as financial information and biometric information etc. of the employees of XYZ India is shared with the XYZ Inc.
What necessary steps need to be taken before actual sharing of the aforesaid information happens?
1. Seek consent from the employees of XYZ India before sharing the information;
2. A lawful contract between the XYZ Inc and XYZ India regarding the terms of sharing and data protection measures to be taken, with the obligation on XYZ Inc of not sharing the received information further without permission from Indian entity;
3. The XYZ Inc should agree to provide better or at-par level of data protection as prescribed in the IT (Amendment) Act, 2008;
4. The country in which the XYZ Inc is located should ensure better or same level of data protection as prescribed in the IT (Amendment) Act, 2008

• A.1 and 2
• B.1, 2 and 3
• C.2 and 3
• D.1 and 4

Comment: *

Name: *

Email: *

Verification: *

With respect to 'Data Minimization' privacy principle, please select the correct statements from the following:

• A.Right to object by the data subject for minimizing the collection of personal information
• B.Data controllers should limit the amount of data collected to what is directly relevant and necessary to accomplish a specified purpose
• C.Data controllers should retain the data only for as long as is necessary to fulfil the purpose for which it was collected
• D.Process of analyzing and minimizing the collected data into useful information

Comment: *

Name: *

Email: *

Verification: *