nd Privacy and Data Protection for Delivery 1. As part of project execution if you have to process client data for a purpose relevant for delivering the service but not originally stated by client, what would you do? Oa. As long as the processing is relevant for delivering the service, we may decide on how to process Ob. We have to obtain client permission before processing, even if it is relevant for the service Oc. We may outsource such processing in which case we will no longer be liable Od. If we can pseudonymize such personal data, we do not have inform or take client approval 2. In a client project while working in client work environment you would like to process certain client Personal data which requires certain approved tools which you are not able to access since the credentials are available only for your colleague who is on leave today. What would be the acceptable action? Oa. Inform client and request them for access to the tool, and then carry out processing Ob. Since client work can't be impacted, upload data into a reasonable safe publicly available tool and process them Oc. Send the data to your Gmail and from your personal machine do the processing by uploading data into a reasonable safe publicly available tool and process them Od. Take approval of your offshore Manager and proceed with uploading data into a reasonable safe publicly available tool and process them 3. Which of the following is not likely to be personally identifiable information? Oa. Contact number of client manager with whom Infosys engages as part of project delivery Ob. Client provided personal financial information of its customers, that has been anonymized Oc. Contact number of a prospective client with whom Infosys is engaging for business opportunity Od. Personal information processed by Infosys as part of project execution 4. You are about to receive personal information from client as part of project execution. Which of the following is most appropriate about international data transfers? Oa. If you will have it transferred to offshore team using citrix client so that only data is viewed but cannot be copied to local machine, then you don't have to inform client Ob. We have a duty to inform client about location of processing, and let them determine and prescribe appropriate safeguards to be deployed by us Oc. If you deploy appropriate safeguards such as encryption and data masking, data may be stored anywhere in the world. Od. In the internet era, any data may be accessed from anywhere in the world, and since client knows we are a global organization, we don't have to inform client about location of processing 5. You just discovered a data breach caused by our employee pertaining to client data. What among the following would not be an immediate step you would be taking? Oa. Immediately inform the client, if it pertains to client data Ob. Immediately inform the DPO Oc. Immediately inform the DP Authority of the country Od. Do immediate damage control, e.g., remove file where it got disclosed.