CCSP Legal, Risk, and Compliance Practice Question
A multinational company operating in the EU uses a cloud service provider based in the US to process personal data of EU data subjects. The company is considered a data controller under the GDPR. Which of the following must the company ensure is in place to lawfully transfer personal data from the EU to the US?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Standard Contractual Clauses adopted by the European Commission
Under GDPR, transfers of personal data to third countries require an adequate level of protection. Standard Contractual Clauses (SCCs) are a valid transfer mechanism approved by the European Commission.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A binding corporate rule approved by the US Department of Commerce
Why it's wrong here
BCRs are for intra-group transfers and approved by EU DPAs, not the US Department of Commerce.
- ✓
Standard Contractual Clauses adopted by the European Commission
Why this is correct
SCCs are a standard data transfer mechanism under GDPR for transfers to third countries.
- ✗
An adequacy decision by the US Federal Trade Commission
Why it's wrong here
Adequacy decisions are made by the European Commission, not the FTC.
- ✗
A data processing agreement solely between the cloud provider and the data subjects
Why it's wrong here
Data processing agreements are between controller and processor, not with data subjects.
Go deeper
Related to this question
About these practice questions
This CCSP question is part of Courseiva's 964-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.