A CISO claims that GDPR security of processing is fully satisfied by completing PCI-DSS checklists alone. Which statement best corrects that claim?
Select an answer to reveal the explanation.
Short Explanation
PCI is a useful toolkit for card data—not a substitute passport for every GDPR processing risk. The legal bar is appropriate TOMs matched to what you actually do with personal data. One industry checklist cannot swallow that whole standard.
Full Explanation
The GDPR legal standard is risk-based appropriate technical and organisational measures for the personal-data processing at issue—not equivalence to any single industry checklist such as PCI-DSS. A CISO who claims PCI-DSS alone fully satisfies GDPR security confuses a sector payment framework with Article 32’s broader personal-data obligation. PCI-DSS does not legally supersede Article 32 wherever card data might appear. GDPR security does not apply only to payment card numbers. Industry checklists do not always prove adequacy without considering processing risk or context. Exam caveat: sector frameworks inform; they do not replace Article 32’s risk-based standard. Operational check: map PCI controls where card data exists, then separately assess TOMs for other civic personal data (housing, benefits, HR) that PCI never covers. For municipal teams, keep a one-page decision note that states the governing instrument, why competing labels fail, and what evidence would change the conclusion. Document the decision trail so auditors can see how the civic team matched facts to the correct legal category rather than to a slogan. Revisit the conclusion when facts, recipients, or processing purposes change, and record who approved the updated analysis.