hardMultiple ChoiceObjective-mapped
CAS-004 Practice Question: A multinational organization is subject to GDPR…
A multinational organization is subject to GDPR and local data protection laws. A data subject from country X requests deletion of personal data, but the data is also required for a legal hold under country Y's law. What is the BEST course of action?
⚠ Common exam trap
It's easy for candidates to assume GDPR always takes precedence over local laws, but CompTIA tests the understanding that conflicting legal obligations require retaining the data and notifying the data subject, not automatically deleting or escalating.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Retain the data and inform the data subject of the conflicting legal obligation
When a legal hold under country Y's law conflicts with a GDPR deletion request, the organization must retain the data to comply with the legal obligation and inform the data subject of the conflicting legal requirement. GDPR Article 17(3)(e) explicitly allows retention when necessary for compliance with a legal obligation under Union or Member State law. This balances the data subject's right to erasure with overriding legal holds, which are common in e-discovery and litigation scenarios.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Anonymize the data to satisfy both requirements
Why it's wrong here
Anonymization may not satisfy the legal hold.
- ✗
Escalate to the data protection authority
Why it's wrong here
Escalation is premature without first informing the data subject.
- ✓
Retain the data and inform the data subject of the conflicting legal obligation
Why this is correct
This balances compliance requirements transparently.
- ✗
Delete the data to comply with GDPR
Why it's wrong here
Deletion would violate the legal hold requirement.
Go deeper
Related to this question
About these practice questions
One of 968 original CAS-005 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.