Generative AI Leader Practice Question: A financial institution wants to ensure…

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Disable logging of all interactions to minimize data retention

  Why it's wrong here

  GDPR permits processing and logging where a lawful basis, retention limits and data subject rights are satisfied; blanket disabling of logging is not required and can defeat audit and security obligations. It is tempting because data minimisation is a genuine GDPR principle, but the directly required measure is a lawful basis with appropriate safeguards.

• ✓

  Implement a mechanism to obtain user consent before processing data

  Why this is correct

  GDPR requires a lawful basis for processing personal data, and consent is one such basis. Obtaining user consent before processing EU user data directly satisfies that obligation, making it the measure most directly required for the described generative AI service.

• ✗

  Store all prompts and responses in a US-based data center

  Why it's wrong here

  GDPR governs processing of EU residents' data and does not mandate US storage; transferring personal data outside the EEA requires an adequacy decision or appropriate safeguards such as standard contractual clauses. It is tempting because residency feels like a compliance control, but location alone neither satisfies nor breaches the regulation.

• ✗

  Use a model trained only on non-EU data

  Why it's wrong here

  GDPR governs lawful processing, data minimisation and transfers, not the training corpus's geography; an EU-data-trained model can still be compliant with the right legal basis. Training only on non-EU data is tempting as a transfer-avoidance tactic, but it neither satisfies GDPR's other obligations nor prevents EU personal data entering prompts at inference.