A marketing firm receives a client's list of business contacts under a contract that limits how the list may be used, and no statute in its jurisdiction regulates that business contact data. Separately, its clinic subsidiary stores patient health records. Which statement correctly distinguishes the two?

CCSP distinguishes contractual private data, where protection obligations arise from an agreement between parties, from regulated private data, where obligations are imposed by law or regulation regardless of what the parties agree. Here the business contact list is protected because the contract restricts its use; violating those terms creates contractual liability, such as damages or termination. The patient health records are protected health information subject to health privacy law, which imposes mandatory safeguards, use and disclosure limits and breach duties enforced by regulators. Treating every contract-shared data set as health-regulated wrongly extends a sector law to data it does not cover. Swapping the categories because patients sign consent forms misunderstands consent: it may authorize certain uses, but it does not remove the statutory protections that attach to health information. Claiming neither creates obligations until a breach occurs ignores that both carry duties from the outset, contractual for one and statutory for the other. Exam caveat: the same data can be both contractual and regulated, and in many jurisdictions business contact data is covered by general privacy law, which is why the scenario states no statute applies. Operational check: confirm the data inventory records the source of each obligation and the controls each requires.