Which Regulation Covers Individual Data Rights Like Access and Erasure?
Short answer
A GDPR
Question
Key Takeaways
The question tests your ability to differentiate between privacy regulations and security standards, with the common trap being confusion between NIST (a standards organization) and GDPR (a privacy regulation).
The GDPR is the regulation that establishes individual rights such as the right to be informed, the right of access, and the right to be forgotten, distinguishing it from security standards like PCI DSS, NIST, and ISO frameworks.
Common mistake: Choosing NIST is a common mistake because it is widely known in cybersecurity, but it is a standards framework, not a regulation granting individual privacy rights.
Expert Analysis
Why the Answer Is Correct
The GDPR (General Data Protection Regulation) is a comprehensive privacy regulation that explicitly grants individuals rights such as the right to be informed, the right of access, and the right to be forgotten. These rights are central to GDPR's data protection framework. Community comment [2] correctly identifies that GDPR addresses these individual rights directly, and comment [1] reinforces this by categorizing the other options appropriately.
Why the Other Options Are Wrong
PCI DSS is a security standard for payment card data, focused on protecting cardholder information, not individual privacy rights. NIST is the National Institute of Standards and Technology, a US agency that publishes cybersecurity frameworks, but it doesn't grant rights to individuals. ISO is an international standard-setting organization; while ISO/IEC 27701 relates to privacy, it is a management standard, not a regulation that grants legally enforceable individual rights.
Community Comment Notes
Comment [1] provides a useful breakdown: NIST is "Network institute of standards and technology" (a typo, but the correct context), PCI DSS is payment card industry standards, and ISO is international standards. Comment [2] directly states that GDPR addresses the rights named in the question. Comment [3] simply confirms the answer is A. These comments align with the consensus that GDPR is the correct choice.
Official Reference
These links open the official vendor documentation in a new tab.
Exam Strategy
When asked about individual rights such as data access or erasure, immediately think of the GDPR. Memorize the key GDPR rights (informed, access, rectification, erasure, restriction, portability, objection) and remember that standards like NIST and ISO are not regulations.
Community Votes
100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 3 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 3
-
Syl0 👍 2GDPR - General Data Protection Regulation NIST - Network institute of standards and technology, so doesn't have that. PCI DSS - Payment Card Industry Data security standards ISO - International standard for Standardisation
-
jafyyy 👍 1A - Addressed individual rights to be informed, access or to be forgotten among other rights.
-
b82faaf 👍 2 Answered AA. GDPR
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.
Related Analysis
Practice All SY0-701 Questions
Access 100 questions with complete answers and detailed explanations.
View Full SY0-701 Practice Test →