Which statement about GDPR is accurate?

Which statement about GDPR is accurate?

• A. A voluntary industry code for data sharing.
• B. A regulation applicable only to the healthcare sector in the EU.
• C. A legal framework that sets guidelines for the collection and processing of personal information from individuals in the EU.
• D. A data retention standard used by EU merchants.

Answer: (C)

GDPR is a comprehensive legal framework that governs how personal data of individuals in the EU can be collected, stored, used, and shared. It applies to any organization that processes such data, regardless of where the organization is located, and even to entities outside the EU if they offer goods or services to people in the EU or monitor their behavior. It establishes individuals' rights, lawful bases for processing, transparency requirements, breach notification, and protections for cross-border transfers. Because of this broad, binding scope focused on privacy and data protection, the statement describing GDPR as a legal framework that sets guidelines for the collection and processing of personal information from individuals in the EU is the best fit. The other options mischaracterize GDPR as a voluntary industry code, limit it to healthcare, or frame it as a data retention standard, none of which captures the actual breadth and purpose of the regulation.

GDPR is a comprehensive legal framework that governs how personal data of individuals in the EU can be collected, stored, used, and shared. It applies to any organization that processes such data, regardless of where the organization is located, and even to entities outside the EU if they offer goods or services to people in the EU or monitor their behavior. It establishes individuals' rights, lawful bases for processing, transparency requirements, breach notification, and protections for cross-border transfers. Because of this broad, binding scope focused on privacy and data protection, the statement describing GDPR as a legal framework that sets guidelines for the collection and processing of personal information from individuals in the EU is the best fit. The other options mischaracterize GDPR as a voluntary industry code, limit it to healthcare, or frame it as a data retention standard, none of which captures the actual breadth and purpose of the regulation.