A privacy officer needs to explain the difference between contractual data and regulated data to an engineering team. Which statement correctly describes regulated data?
- ARegulated data is data whose protection obligations arise from a private agreement between two commercial parties.
- BRegulated data is any data an organisation voluntarily chooses to classify as sensitive in its internal policy.
- CRegulated data is data that has been anonymised so that it no longer identifies any individual.
- DRegulated data is data whose handling requirements are imposed by law or statute, such as health or personal financial information. Correct
Why A is wrong: This describes contractual data, where obligations flow from an agreement such as a payment card scheme or a customer contract, not from statute.
Why B is wrong: Internal classification is a discretionary business decision; it does not make data regulated, which requires an external legal mandate.
Why C is wrong: Anonymisation removes identifiability and typically takes data out of privacy-law scope, which is the opposite of data being regulated.
Why D is correct: Regulated data carries protection duties set by legislation or regulation, so categories like health records under health-privacy law are the defining example.