Name three common data privacy laws or concepts relevant to analytics.

• A. HIPAA, PCI-DSS, and FERPA
• B. GDPR, CCPA/CPRA, and data minimization principles
• C. SOX, FISMA, and GLBA
• D. DMCA, COPPA, and IDEA

Answer: (B)

This question tests your understanding of privacy frameworks and practices that guide data analytics. GDPR and CPRA/CCPA are two of the most widely referenced privacy regimes shaping how analytics teams collect, process, and share data. GDPR governs data processing in the EU/EEA (and has a broad reach for any organization handling EU residents’ data), emphasizing lawful bases for processing, purpose limitation, data subject rights, security, and data minimization. When conducting analytics under GDPR, you’d map data flows, ensure you have a lawful basis, implement access controls, and apply techniques like anonymization or pseudonymization to protect individuals’ privacy.

CCPA/CPRA operates primarily in California and gives consumers rights over their personal information—things like access, deletion, and the ability to opt out of the sale of data. For analytics, this means clear notices about data use, respect for consumer requests, and careful handling of data that could be deemed a “sale” or restricted processing. CPRA further tightens these requirements and expands protections for sensitive data, which analytics teams must account for in data collection and processing.

Data minimization is a fundamental principle across many privacy laws, including GDPR and CPRA. It says collect only what is necessary to achieve a stated purpose, minimize the amount of personal data stored, and retain data only for as long as needed. In analytics, this translates to designing pipelines that use the least amount of identifiable data, applying aggregation, masking, or anonymization, and implementing solid data governance to limit exposure and risk.

Other options bring up privacy-relevant regimes, but they’re more domain-specific (such as health, education, or finance) or less central to analytics across multiple sectors. The combination of GDPR, CPRA/CCPA, and data minimization captures both broad regulatory influence and a core practice that directly impacts how analytic work is conducted while protecting individuals’ privacy.