Which regulation governs data privacy in the European Union?

• A. EU GDPR
• B. HIPAA
• C. PCI DSS
• D. NIST CSF

Answer: (A)

The main concept is understanding which regulation sets the rules for handling personal data in the European Union. The General Data Protection Regulation, or GDPR, does this by providing a harmonized framework for processing personal data of individuals in the EU/EEA. It applies to any organization that processes EU residents’ data, even if the organization is outside the EU, and it covers what data can be collected, the legal grounds for processing, individuals’ rights (such as access, deletion, and data portability), and the responsibilities of data controllers and processors. It also requires security measures, limits on data use to stated purposes, accountability, and breach notification within 72 hours, plus stringent transfer rules for data leaving the EU.

HIPAA is about health information privacy in the United States, not EU-wide data protection. PCI DSS is a payment card industry security standard focused on protecting card data, not general privacy law. NIST CSF is a voluntary cybersecurity framework from the U.S. government, not an EU data privacy regulation.