easyMultiple SelectObjective-mapped
CCSP Data Sovereignty Practice Question
Which of the following is an example of a data sovereignty law that directly affects cloud data storage?
⚠ Common exam trap
ISC2 often tests the distinction between data sovereignty (geographic storage restrictions) and data security/privacy regulations (which focus on protection controls but not location). This question specifically traps candidates who assume CCPA is a sovereignty law because it is a prominent privacy regulation, but CCPA lacks any data localization mandate, making it an incorrect choice for a data sovereignty question.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
General Data Protection Regulation (GDPR)
The General Data Protection Regulation (GDPR) is a data sovereignty law because it imposes strict requirements on the storage and processing of personal data of EU residents, mandating that data be stored within the EU or in jurisdictions with equivalent protection, directly affecting where cloud providers can host data. It enforces data localization principles through mechanisms such as Standard Contractual Clauses (SCCs) and Binding Corporate Rules (BCRs), requiring cloud customers to ensure their provider's storage regions comply with these territorial restrictions. In contrast, the California Consumer Privacy Act (CCPA) is a privacy law that grants consumers rights over their personal data but does not mandate where data must be stored geographically, so it is not a data sovereignty law. The other options (SOX, PCI DSS, HIPAA) are security or sector-specific regulations without territorial storage requirements.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
General Data Protection Regulation (GDPR)
Why this is correct
GDPR is a data sovereignty law because it mandates that personal data of EU residents be stored within the EU or in jurisdictions with equivalent protection, directly affecting cloud storage location decisions.
- ✗
Sarbanes-Oxley Act (SOX)
Why it's wrong here
The Sarbanes-Oxley Act (SOX) is a financial reporting and corporate governance law for public companies. It does not impose any geographic storage requirements on data, so it is not a data sovereignty law.
- ✗
California Consumer Privacy Act (CCPA)
Why it's wrong here
The California Consumer Privacy Act (CCPA) is a privacy law that grants consumers rights over their personal data, but it does not mandate where data must be stored geographically. Therefore, it is not a data sovereignty law.
- ✗
Payment Card Industry Data Security Standard (PCI DSS)
Why it's wrong here
The Payment Card Industry Data Security Standard (PCI DSS) is a security standard for protecting payment card data. It does not include any data localization requirements, so it is not a data sovereignty law.
- ✗
Health Insurance Portability and Accountability Act (HIPAA)
Why it's wrong here
The Health Insurance Portability and Accountability Act (HIPAA) is a healthcare privacy and security law. It does not mandate specific geographic storage locations for data, so it is not a data sovereignty law.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CCSP question from scratch — 964 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.