hardMultiple ChoiceObjective-mapped
CISA Practice Question: A multinational company must comply with GDPR and…
A multinational company must comply with GDPR and local data protection laws when transferring personal data from the EU to a subsidiary in the US. Which transfer mechanism is most commonly accepted as providing adequate protection?
⚠ Common exam trap
Many exam-takers confuse Binding Corporate Rules (BCRs) as the default intra-group mechanism, but SCCs are more commonly used because they are pre-approved, faster to implement, and do not require supervisory authority approval, making them the practical choice for most multinational transfers.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Standard Contractual Clauses (SCCs) adopted by the European Commission.
Standard Contractual Clauses (SCCs) are pre-approved model contracts issued by the European Commission that provide a legally recognized mechanism for transferring personal data from the EU to a third country, such as the US, without requiring additional authorization. They are the most commonly accepted transfer mechanism because they impose contractual obligations on both the data exporter and importer to ensure adequate data protection, aligning with GDPR Article 46 requirements.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A data protection impact assessment (DPIA) approved by the local supervisory authority.
Why it's wrong here
A DPIA is a process to assess risk but is not a transfer mechanism; it may be required in addition to SCCs.
- ✓
Standard Contractual Clauses (SCCs) adopted by the European Commission.
Why this is correct
SCCs are a ready-to-use mechanism that provides contractual guarantees of adequate protection for cross-border data transfers.
- ✗
Explicit consent from each data subject for the transfer.
Why it's wrong here
Consent can be withdrawn and is not considered a reliable long-term transfer mechanism under GDPR.
- ✗
Binding Corporate Rules (BCRs) for intra-group transfers.
Why it's wrong here
BCRs require approval from the relevant EU data protection authority and are designed for intra-group transfers, but the question asks for the mechanism *most commonly accepted* as providing adequate protection. The Standard Contractual Clauses (SCCs) are the default, pre-approved mechanism under GDPR Article 46, requiring no prior supervisory authority approval for each transfer. BCRs would be correct if the scenario specified a multinational seeking a single, legally binding data protection policy for all group entities, but here the emphasis on "most commonly accepted" points to SCCs’ broader, more immediate applicability.
Go deeper
Related to this question
About these practice questions
One of 995 original CISA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.