Sectoral and Cross-Jurisdictional IT Regulation

Introduction and Context

Information technology regulation is not a single, universal body of law. It is a layered system in which general privacy, cybersecurity, consumer-protection and intellectual-property rules interact with sector-specific obligations. A bank, hospital, telecommunications operator, government agency and university may all process the same categories of data—identity information, communications metadata, financial records or biometric identifiers—yet face different duties because their institutional risks, public functions and regulatory histories differ.

The problem becomes more difficult when data, people, cloud infrastructure and service providers cross borders. A transaction may involve a customer in one country, a regulated entity in a second, a cloud region in a third and a support team in a fourth. The organisation must then determine which laws apply, whether data may leave a territory, what contractual safeguards are needed, which regulator has authority and how conflicting legal demands should be handled.

This chapter develops a comparative framework for analysing these issues. It treats compliance as an operating capability rather than a checklist. The central question is not merely “Where is the server?” but “Which legal interests are engaged, who controls the processing, what risk is created, and what evidence demonstrates lawful and secure governance?” Laws change frequently; therefore, legal conclusions must always be validated against current primary sources, regulatory guidance and sectoral licences.

Learning Objectives

By the end of this chapter, students should be able to:

1. Compare the regulatory logic of finance, healthcare, telecommunications, government and education.
2. Distinguish generally applicable technology regulation from sector-specific obligations.
3. Analyse cross-border data transfers, data localisation, conflicts of law and regulatory harmonisation.
4. Design a defensible compliance architecture involving governance, contracts, technical controls and evidence.
5. Evaluate a complex multinational incident and recommend proportionate action.

1. A Layered Model of IT Regulation

A useful model has four layers:

These layers are cumulative. A hospital using a cloud provider may be subject simultaneously to a general data-protection law, a health-records statute, public-sector procurement rules, professional secrecy, contractual security commitments and cyber-incident reporting requirements.

1.1 Scope, nexus and extraterritoriality

A law may apply because of:

• the organisation’s place of establishment;
• the location or nationality of the individual;
• the location of the conduct or infrastructure;
• the offering of goods or services into a jurisdiction;
• the monitoring of behaviour in a jurisdiction;
• the location of a regulated financial, health or communications activity; or
• the effects of conduct within the jurisdiction.

These connecting factors are called legal nexus. A company cannot safely assume that incorporation in one country excludes the law of another. For example, a privacy regime may apply to a foreign organisation that offers services to residents or monitors their behaviour. A financial supervisor may regulate an overseas cloud arrangement because a licensed institution remains responsible for operational resilience.

1.2 Controller, processor and independent obligation

Modern privacy regimes commonly distinguish an entity deciding why and how personal data are processed from an entity processing data on its behalf. Terminology varies: “controller” and “processor” are prominent in European frameworks, while other laws use “business,” “service provider,” “covered entity” or “business associate.” The distinction is functional, not merely contractual.

A processor may have direct statutory duties concerning security, sub-processing and assistance. A contract cannot eliminate the controller’s accountability to individuals or regulators. In sectoral law, an organisation may also have independent duties unrelated to privacy classification. A bank remains responsible for resilience; a telecom operator remains responsible for lawful interception controls; and a university remains responsible for student records even when a vendor hosts them.

1.3 Risk-based and rule-based regulation

Rule-based requirements specify conduct, such as retaining telecommunications records for a defined period or obtaining consent for a particular disclosure. Risk-based regulation requires an organisation to identify threats and implement proportionate safeguards. Most mature systems combine both approaches.

A risk model can be expressed conceptually as:

Here, likelihood is the estimated probability of a harmful event and impact is the magnitude of legal, financial, operational, safety or human-rights consequences. This is not a legal formula and does not replace statutory tests. It is a governance aid. Scores should be comparable only when their scales and assumptions are defined consistently. A low-probability disclosure of a small dataset may be less serious than a similar event involving genomic data, payment credentials or emergency-service communications.

2. Sectoral Regulatory Logics

2.1 Finance

Financial regulation is concerned with systemic stability, prudential soundness, market integrity, consumer protection and operational continuity. Information systems support payments, trading, credit assessment, identity verification and anti-money-laundering controls; failure can harm both an institution and the wider economy.

Typical requirements include:

• governance by the board and senior management;
• segregation of duties and least-privilege access;
• strong authentication and privileged-access monitoring;
• records that are accurate, tamper-evident and retrievable;
• business continuity, disaster recovery and tested recovery arrangements;
• outsourcing and cloud-risk oversight;
• incident notification to financial supervisors;
• anti-money-laundering, sanctions and customer-due-diligence controls;
• retention of transaction and audit records; and
• resilience testing, including scenario-based exercises.

Financial privacy is important, but confidentiality is not the only objective. Regulators may require information sharing for fraud detection, supervision, lawful investigations or sanctions compliance. This creates tension between data minimisation and regulatory retention or disclosure duties.

A bank should therefore maintain a data and service inventory that identifies critical functions, recovery objectives, subcontractors, processing locations, administrator access and exit arrangements. Contractual rights to audit, obtain assistance during incidents, recover data and terminate safely are particularly important.

2.2 Healthcare

Healthcare regulation protects confidentiality while preserving availability and clinical utility. The consequences of error may include physical injury or death, not merely economic loss. Health data are generally treated as sensitive because they reveal diagnoses, treatment, genetic characteristics, disability or reproductive information.

Core obligations commonly include:

• confidentiality and professional secrecy;
• lawful and purpose-specific use of patient information;
• access controls based on role and treatment relationship;
• audit trails for viewing and changing records;
• integrity and availability of clinical information;
• patient access and correction mechanisms;
• carefully controlled research, analytics and secondary use;
• breach assessment and notification; and
• special safeguards for children, genetic data and mental-health information.

Healthcare systems illustrate the difference between availability and confidentiality. An emergency clinician may need rapid access, while an unauthorised employee must be prevented from browsing records. Effective design therefore uses emergency access procedures, “break-glass” logging, retrospective review and strong identity management rather than simply denying access.

Artificial intelligence introduces additional issues. A clinical model may process identifiable records, reproduce bias, generate unsafe recommendations or make it difficult to explain a decision. Governance should address data provenance, validation, human oversight, monitoring for performance drift and a clear allocation of clinical responsibility. Compliance with a privacy law does not establish that an AI system is clinically safe.

2.3 Telecommunications

Telecommunications regulation is shaped by essential-service characteristics, scarce resources and the special sensitivity of communications. Operators may be subject to licensing, quality-of-service, numbering and spectrum rules, universal-service obligations, consumer-protection duties, network-security requirements and lawful-interception frameworks.

Important categories include:

• communications secrecy and confidentiality;
• traffic and location data protection;
• lawful interception under authorised legal process;
• retention or production of specified records where legally required;
• availability and resilience of networks;
• protection of signalling, routing and interconnection systems;
• spam, fraud and caller-identification controls; and
• reporting of significant outages or cyber incidents.

Telecommunications metadata can be as revealing as content. A sequence of locations, contacts and times may disclose a person’s relationships, workplace, medical visits or political activity. Retention must therefore have a clear legal basis, limited access, defined duration and secure disposal. Operators should distinguish content, traffic data, subscriber data and location data because the applicable rules may differ.

Lawful interception creates a cross-border conflict when one state demands access that another state’s law prohibits. A provider should not treat an informal request as sufficient authority. It should verify jurisdiction, legal process, scope, necessity and any applicable notification or secrecy rules, escalating conflicts to legal counsel and the relevant authorities.

2.4 Government and public administration

Government IT regulation is influenced by sovereignty, public accountability, national security, procurement law and constitutional rights. Public bodies often hold large and interconnected datasets, including tax, identity, welfare, immigration, education and health information.

Typical requirements include:

• statutory authority for collection and use;
• transparency and administrative fairness;
• records-management and freedom-of-information duties;
• secure procurement and supplier oversight;
• accessibility and non-discrimination;
• public-sector cybersecurity baselines;
• continuity of essential public services;
• lawful information sharing between agencies; and
• special controls for classified or national-security information.

Public bodies cannot always rely on consent. A welfare agency, for example, may have a statutory mandate, while consent may be ineffective where individuals have no meaningful choice. Public-sector processing should instead be tied to legal authority, necessity, proportionality and procedural safeguards.

Automated government decisions require particular care. Individuals may need notice, reasons, human review and a route to challenge an adverse decision. Procurement language should not allow vendor secrecy to defeat statutory transparency or accountability.

2.5 Education and research

Universities combine several legal identities: employer, educational institution, research organisation, sometimes healthcare provider, and occasionally public authority. They process student records, examination materials, disability information, payment details, research data and intellectual property.

Regulatory issues include:

• student and learner privacy;
• child protection where minors are involved;
• academic records and retention;
• research ethics and informed participation;
• cross-border collaboration and transfer of research data;
• intellectual-property ownership and publication;
• accessibility and equal treatment;
• acceptable use, academic freedom and cybersecurity; and
• third-party learning platforms and proctoring technologies.

Educational institutions face a difficult balance between monitoring and autonomy. Online proctoring, behavioural analytics and generative-AI detection may intrude into private spaces or produce unreliable inferences. Proportionality, alternatives, transparency, appeal mechanisms and independent validation are essential.

2.6 Comparative view

The same control may have different significance. Encryption is valuable in every sector, but healthcare may prioritise rapid clinical availability, finance may emphasise transaction integrity, and government may impose classified-environment restrictions on encryption technology or cloud location.

3. Cross-Border Data Transfers

3.1 Transfer is broader than physical movement

A transfer may occur when data are uploaded to a foreign cloud region, remotely accessed by staff abroad, replicated for disaster recovery, viewed by a foreign support team or disclosed to an overseas affiliate. The relevant question is often whether data become available to a person or organisation subject to another jurisdiction, not merely whether a server crosses a border.

Before transferring data, an organisation should identify:

1. the data categories and affected individuals;
2. the purpose, legal basis and sectoral authority;
3. the exporting and importing entities;
4. every country involved, including remote-access locations;
5. onward-transfer and sub-processing arrangements;
6. applicable transfer mechanisms;
7. government-access and surveillance risks;
8. security and pseudonymisation measures; and
9. return, deletion and audit arrangements.

3.2 Transfer mechanisms

Mechanisms vary by jurisdiction but commonly include:

• an adequacy or equivalent decision recognising protection in the destination;
• statutory exceptions for limited circumstances;
• standard contractual clauses or approved model terms;
• binding intra-group rules;
• sector-approved arrangements;
• explicit consent, where valid and genuinely voluntary; and
• derogations for legal claims, public interest or emergencies.

A contract alone may be insufficient. Organisations may need to assess whether the importer can comply with confidentiality, access, deletion and government-request obligations. Supplementary safeguards can include encryption with keys controlled by the exporter, tokenisation, strict access management, split processing, transparency reports and technical separation of identifiers.

Encryption is not automatically a complete solution. If the foreign recipient controls the decryption key, it may have unrestricted access. Even strong encryption may not protect metadata, account identifiers or information revealed through operational context.

3.3 Localisation

Data localisation ranges from a requirement to store data domestically, to a prohibition on foreign processing, to an obligation to maintain a local copy or make data available to domestic authorities. Localisation can support sovereignty, supervisory access and public confidence, but it may increase cost, reduce redundancy and create concentrated local risk.

Local storage does not necessarily prevent foreign access. A multinational provider may administer a domestic server from abroad, and a foreign parent company may receive compelled disclosure. Conversely, foreign hosting does not automatically mean unlawful processing if an effective transfer mechanism and safeguards exist.

A mature compliance decision compares legal, operational and security effects rather than treating localisation as inherently safer. It should ask whether local infrastructure is resilient, whether domestic authorities have lawful access, whether cross-border support is necessary and whether the arrangement can be exited.

4. Conflicts of Law and Regulatory Harmonisation

4.1 Types of conflict

A conflict may be direct, such as one country prohibiting disclosure while another orders it. It may be procedural, such as different breach-notification deadlines or incompatible records-retention rules. It may also be conceptual: one regime treats an organisation as a controller, while another imposes duties on the same organisation as a communications carrier or public contractor.

Common conflict areas include:

• privacy versus compelled disclosure;
• data deletion versus financial or health-record retention;
• localisation versus cloud resilience;
• secrecy obligations versus information-sharing duties;
• employee monitoring versus labour and privacy rights;
• freedom of expression versus content-removal orders; and
• open research versus confidentiality or export controls.

4.2 A conflict-resolution method

A defensible method is:

First, map the facts. Identify people, entities, systems, data flows, decisions, locations and dates.

Second, map legal nexus. Determine which laws apply and why, distinguishing mandatory law from guidance and contractual commitments.

Third, classify the conflict. Is it a true impossibility, a difference in timing, a difference in standards, or an uncertainty that can be managed through safeguards?

Fourth, rank authority. Consider constitutional requirements, statutes, regulations, licence conditions, court orders and contracts. A private agreement cannot override mandatory law.

Fifth, seek the least-conflict design. Reduce data, segment environments, localise only the affected function, use independent access controls or change the processing purpose.

Sixth, document escalation. Record assumptions, advice, regulator contact, decision owners, residual risk and review dates.

Seventh, preserve reversibility. Maintain a credible exit plan, data portability and the ability to suspend a transfer without disabling essential services.

4.3 Harmonisation

Regulatory harmonisation does not always mean identical laws. It may involve common principles, interoperable certifications, mutual recognition, shared technical standards or coordinated supervisory practice. International instruments and standards can reduce friction, but they do not eliminate local mandatory rules.

Examples of harmonising influences include internationally recognised security-management standards, privacy principles, financial messaging standards, health interoperability specifications and regional adequacy arrangements. Their value depends on scope: a security certification may evidence controls but does not itself create a lawful basis for processing or authorise a cross-border disclosure.

Organisations should distinguish:

• legal equivalence, where one jurisdiction formally recognises another’s protection;
• technical interoperability, where systems exchange data reliably; and
• governance interoperability, where roles, audit evidence and incident processes align.

A programme may achieve technical interoperability while remaining legally non-compliant.

5. Compliance Architecture for Multinational IT Operations

A practical architecture has six connected capabilities:

1. Regulatory inventory: laws, licences, regulator guidance, contractual duties and pending reforms.
2. Data and service mapping: data elements, purposes, owners, systems, locations, vendors and access paths.
3. Control library: identity, encryption, logging, retention, resilience, secure development and incident response.
4. Contract governance: processing terms, audit rights, sub-processor approval, government requests, breach support, deletion and exit.
5. Assurance and evidence: risk assessments, test results, training records, access reviews, audit trails and management decisions.
6. Change management: monitoring legal developments, architecture changes, acquisitions, new AI uses and regulator communications.

Control ownership should be explicit. Legal teams interpret obligations; security teams implement safeguards; architects design systems; procurement negotiates supplier terms; business owners justify purpose and retention; and senior management accepts residual risk. Compliance fails when every function assumes another function is responsible.

A useful control matrix identifies the strictest applicable requirement while preserving sector-specific nuance.

6. Applied Case: Northstar Digital Services

The following is a fictional illustrative case.

Background

Northstar is a financial-technology group headquartered in Country A. It provides mobile payments to customers in Countries A, B and C. Its application stores identity and transaction data in a regional cloud, uses a fraud-detection provider in Country D, and employs a support centre in Country E. A healthcare partner in Country B uses Northstar’s payment service for insurance reimbursements. Northstar also supplies a government benefits card in Country C.

Problem

Country B requires certain health-related reimbursement records to remain accessible domestically. Country C requires government-benefit data to be hosted locally and prohibits some foreign administrative access. Country D’s law permits authorities to demand data from the fraud provider, while Country A’s privacy regime restricts transfers without safeguards. A ransomware incident then affects the regional cloud. No payment records are lost, but support staff in Country E temporarily access customer profiles to restore service.

Analysis

Northstar initially treated all information as “payment data.” That classification was inadequate. The dataset contained ordinary identity data, financial transactions, health-related reimbursement information and government-benefit records. Each category triggered different legal and contractual concerns.

The incident also involved availability and remote access, not merely data exfiltration. The support centre’s access was a cross-border processing event. The fraud provider’s exposure to government demands created an onward-transfer and compelled-disclosure risk. Finally, the local-hosting requirement in Country C applied to a government programme even though Northstar’s commercial payment service was not generally subject to the same rule.

Approach and solution

Northstar adopted the following architecture:

• separate logical environments for commercial payments, health-linked reimbursements and government benefits;
• domestic hosting and domestic privileged administration for the Country C programme;
• tokenisation so the fraud provider received a limited identifier rather than full identity data;
• encryption keys controlled separately from the cloud infrastructure;
• pre-approved emergency access by named support personnel, with session recording and retrospective review;
• contracts addressing sub-processors, government requests, incident assistance, deletion and exit;
• a transfer impact assessment for the fraud provider and support centre;
• sector-specific retention schedules rather than one universal deletion rule; and
• coordinated notification analysis for financial, privacy and sector regulators.

Northstar also created a conflict register. Each entry recorded the rule, affected system, responsible owner, legal interpretation, technical mitigation, residual risk and review date.

Outcome

The company restored service without evidence of unauthorised disclosure. The regulator accepted the incident report but required stronger privileged-access controls and proof that domestic administration of the government environment was genuine rather than merely contractual. Northstar’s costs increased, but the segmented design reduced the scope of future incidents and made regulatory evidence easier to produce.

Learning points

1. Data classification must reflect legal context, not only technical format.
2. Remote access can create a transfer even when storage remains domestic.
3. Localisation must be tested against administrative access and parent-company control.
4. Tokenisation reduces exposure but does not automatically remove regulatory responsibility.
5. Sectoral compliance requires a common control foundation plus differentiated requirements.
6. Incident response must integrate technical containment, legal analysis, regulator communication and evidence preservation.

7. Challenges, Ethics and Contemporary Developments

The principal challenge is regulatory fragmentation. Organisations may face overlapping definitions, different deadlines, inconsistent transfer rules and uncertain regulator expectations. Excessive compliance can also produce defensive data practices: retaining everything “just in case,” denying legitimate access or excluding beneficial digital services from high-risk regions.

Ethically, legality is a minimum threshold. A technically lawful monitoring programme may still be disproportionate, discriminatory or harmful. Data minimisation, purpose limitation, accessibility, explainability and meaningful redress should be treated as governance values, not only legal phrases.

Cloud concentration and artificial intelligence are changing the risk landscape. A small number of cloud providers may become critical dependencies across several sectors. AI systems may transfer data through prompts, telemetry, model training or third-party APIs. Organisations should inventory these flows, prohibit unapproved sensitive-data inputs, assess model providers, retain decision records and establish human review for high-impact uses.

Regulatory convergence is likely in areas such as incident reporting, software supply-chain security, critical infrastructure resilience and AI governance. Convergence should not be mistaken for uniformity. Local requirements concerning sovereignty, children, health, national security and public records will continue to differ.

Best-Practice Checklist

A postgraduate compliance professional should be able to ask:

• What legal and sectoral nexus makes each rule applicable?
• Which entity determines purposes, and which entities have independent duties?
• What are the complete data and remote-access flows?
• Which systems are critical to safety, finance, communications or public services?
• What transfer mechanism applies, and what happens if it fails?
• Can a foreign authority compel access, and how will the organisation respond?
• Are retention and deletion rules genuinely reconciled?
• Are controls tested, evidenced and assigned to accountable owners?
• Can the organisation isolate, continue and exit the service?
• Are affected individuals given meaningful transparency and remedy?

Chapter Summary

Sectoral IT regulation reflects the distinctive risks of finance, healthcare, telecommunications, government and education. Finance prioritises systemic stability and operational resilience; healthcare combines confidentiality with patient-critical availability; telecommunications protects communications and network continuity; government must reconcile sovereignty with rights and public accountability; and education balances learner protection, research freedom and institutional openness.

Cross-border compliance requires analysis of legal nexus, data flows, remote access, transfer mechanisms, government-access risk and onward transfers. Localisation can support sovereignty but does not automatically prevent foreign access or improve security. Conflicts of law should be managed through factual mapping, authority analysis, least-conflict design, documented escalation and reversible architecture. Harmonisation can improve interoperability without eliminating national requirements.

The most effective compliance programme combines legal interpretation, sector-specific governance, technical controls, contract management, assurance evidence and continuous change management. Compliance is therefore an organisational capability for making lawful, secure and accountable technology decisions across jurisdictions.

Key Terms

Legal nexus: A connection that makes a jurisdiction’s law applicable to conduct, persons, data or effects.

Sectoral regulation: Rules designed for a particular industry or institutional function.

Horizontal regulation: Generally applicable rules, such as privacy or cybersecurity law.

Controller: An entity that determines the purposes and essential means of processing, where that legal terminology applies.

Processor: An entity that processes personal data on behalf of another entity.

Data localisation: A requirement or practice concerning domestic storage, processing or access to data.

Cross-border transfer: Making data available across jurisdictions, including through remote access.

Adequacy decision: A formal recognition that a destination provides an acceptable level of protection.

Standard contractual clauses: Approved contractual terms intended to govern specified international transfers.

Onward transfer: A subsequent disclosure or movement from an initial recipient to another entity or jurisdiction.

Regulatory harmonisation: Coordination or alignment of laws, standards or supervisory practices.

Operational resilience: The ability to prevent, withstand, recover from and adapt to disruption.

Lawful interception: Access to communications authorised through applicable legal process.

Privileged access: Access that permits significant administrative or security actions.

Purpose limitation: Using data only for specified, legitimate and compatible purposes.

Data minimisation: Limiting data collection and use to what is necessary and proportionate.

Transfer impact assessment: An evaluation of legal, organisational and technical risks in an international transfer.

Residual risk: Risk remaining after controls and mitigations are applied.

Regulatory evidence: Records demonstrating that required governance and controls exist and operate.

Review Questions

Short Answer Questions

1. Why can a cloud arrangement create cross-border processing even when data are stored domestically?
2. Identify two regulatory priorities that distinguish healthcare from finance.
3. What is the difference between technical interoperability and legal equivalence?
4. Why is consent often an unsuitable basis for government processing?
5. List four elements that should be included in a transfer impact assessment.

Long Answer Questions

1. Compare the regulatory objectives and characteristic IT controls of finance, healthcare and telecommunications.
2. Explain how a multinational organisation should analyse and manage a conflict between a foreign disclosure order and domestic privacy law.
3. Critically evaluate data localisation as a method of improving sovereignty and cybersecurity.
4. Discuss the governance implications of AI in healthcare, government and education.
5. Design a compliance architecture for a university using international cloud services and processing health-related research data.

Analytical / Application Questions

1. A bank uses a foreign fraud-detection provider that receives pseudonymised transaction data. Analyse the transfer, re-identification, government-access and contractual risks, and recommend controls.
2. A telecom operator is ordered by one country to disclose location metadata while another country prohibits disclosure without judicial authorisation. Apply the conflict-resolution method in this chapter.
3. A government university partnership uses an overseas learning platform for student assessments. Identify the sectoral obligations, cross-border issues, ethical risks and evidence the partnership should maintain.

Multiple Choice Questions with Answers

Question 1

Which factor most directly establishes a legal nexus for an extraterritorial privacy law?

A. The organisation owns a printer in the jurisdiction

B. The organisation offers services to residents of the jurisdiction

C. The organisation uses an open-source database

D. The organisation has a global brand

Correct Answer: B. The organisation offers services to residents of the jurisdiction

Question 2

Which sector is most directly concerned with systemic stability, payment integrity and prudential supervision?

A. Education

B. Telecommunications

C. Finance

D. Healthcare

Correct Answer: C. Finance

Question 3

Why may domestic storage fail to eliminate cross-border compliance obligations?

A. Domestic storage always violates privacy law

B. Remote foreign administration may still make data available abroad

C. Encryption cannot be used domestically

D. Local servers cannot create audit logs

Correct Answer: B. Remote foreign administration may still make data available abroad

Question 4

Which is the strongest description of regulatory harmonisation?

A. A guarantee that all national laws become identical

B. Coordination or alignment of laws, standards or supervisory practices

C. A prohibition on sector-specific regulation

D. Replacement of contracts by technical controls

Correct Answer: B. Coordination or alignment of laws, standards or supervisory practices

Question 5

In healthcare, what is the principal reason for using controlled emergency or “break-glass” access?

A. To eliminate all access logging

B. To permit urgent clinical access while enabling retrospective review

C. To allow unrestricted employee browsing

D. To replace authentication permanently

Correct Answer: B. To permit urgent clinical access while enabling retrospective review

Question 6

Which control most directly reduces the data exposed to a fraud-detection provider?

A. Tokenisation

B. Longer retention

C. Open administrator access

D. Disabling audit logs

Correct Answer: A. Tokenisation

Question 7

A contract with a cloud provider is best understood as:

A. A complete substitute for statutory compliance

B. One component of governance that allocates operational responsibilities

C. A waiver of regulator authority

D. Proof that no cross-border transfer exists

Correct Answer: B. One component of governance that allocates operational responsibilities

Question 8

Which issue is especially characteristic of telecommunications regulation?

A. Clinical trial consent

B. Lawful interception and communications secrecy

C. Academic authorship only

D. Financial capital adequacy only

Correct Answer: B. Lawful interception and communications secrecy

Question 9

What should an organisation do first when analysing a conflict of laws?

A. Delete all potentially relevant data

B. Map the facts, entities, systems, data flows and locations

C. Assume the strictest law applies everywhere

D. Ask the vendor to choose the governing law

Correct Answer: B. Map the facts, entities, systems, data flows and locations

Question 10

Which statement about security certification is correct?

A. Certification automatically creates a lawful basis for processing

B. Certification can provide assurance evidence but does not replace legal analysis

C. Certification eliminates government-access risk

D. Certification makes localisation requirements irrelevant

Correct Answer: B. Certification can provide assurance evidence but does not replace legal analysis