An IT manager is constructing an enterprise regulatory compliance matrix for system administrators and technicians. Match each privacy regulation or compliance standard on the left with its corresponding technical safeguard or operational requirement on the right.
- General Data Protection Regulation (GDPR)Mandating automated workflows for complete data erasure upon consumer request and enforcing explicit opt-in consent for telemetry tracking.
- Health Insurance Portability and Accountability Act (HIPAA)Enforcing mandatory audit logging, strict role-based access controls, and storage encryption for individually identifiable medical diagnostic and treatment records.
- Payment Card Industry Data Security Standard (PCI-DSS)Requiring strict network segment isolation and strong encryption for systems storing Primary Account Numbers (PAN), while prohibiting persistent storage of sensitive authentication values.
- Family Educational Rights and Privacy Act (FERPA)Restricting access to academic transcripts and directory information to authorized institutional personnel with legitimate educational needs.
Answer
General Data Protection Regulation (GDPR) pairs with automated data erasure workflows and consent management; Health Insurance Portability and Accountability Act (HIPAA) pairs with access controls and audit logging for Protected Health Information; Payment Card Industry Data Security Standard (PCI-DSS) pairs with network isolation and encryption for cardholder data; Family Educational Rights and Privacy Act (FERPA) pairs with access restrictions on student academic records.
Each regulatory compliance framework imposes operational requirements targeted at specific types of regulated data: GDPR enforces consumer privacy rights such as explicit consent and right to erasure; HIPAA mandates technical access controls, logging, and encryption for Protected Health Information (PHI); PCI-DSS governs payment card handling by mandating network segmentation and prohibition of CVV storage; FERPA protects student academic records from unauthorized disclosure.
Step-by-Step Solution
Key Concept
Data Privacy Frameworks and Operational Technical Controls