A tourism board confuses “European data protection legislation principles” with ISO 27001 controls. Which response keeps the answer in the correct CIPP/E legal-principle space?
Select an answer to reveal the explanation.
Short Explanation
ISO 27001 is a security management gym membership; GDPR principles are the legal traffic laws. Fairness, purpose limitation, and friends live in the statute. A shiny ISO certificate helps prove security practice, but it does not rewrite or replace European data-protection legislation principles on the CIPP/E exam.
Full Explanation
European data-protection legislation principles include legal concepts such as fairness, purpose limitation, and related lawful-processing principles; ISO 27001 is a security-management standard, not a substitute for those legislative principles. Tourism boards should keep CIPP/E answers in the legal-principle space when stems contrast ISO catalogues with GDPR Article 5 themes. ISO 27001 Annex A is not itself the GDPR’s Article 5 principle list with identical legal force. CIPP/E does not test only NIST SP 800-53 control families as European legislative principles. Holding an ISO certificate does not exempt tourism boards from European DP principles. Exam caveat: principle-versus-standard distractors are common—pick legislative principles. Operational check: map ISO controls as evidence supporting Article 32 security measures, while separately documenting Article 5 principle compliance in the record of processing—never collapse the two into “we are ISO certified so principles are done.” For municipal teams, keep a one-page decision note that states the governing instrument, why competing labels fail, and what evidence would change the conclusion. Document the decision trail so auditors can see how the civic team matched facts to the correct legal category rather than to a slogan.