Compliance.

Regulatory compliance and data governance for developers. Covers 8 sub-skills.

• Compliance · 1 of 3

  SOC 2 Controls

  Under the current AICPA SOC 2 guidance used in 2025-2026, what does a Type 2 report attest to that a Type 1 does not?

  ADesign suitability of controls at a single point in timeBOperating effectiveness of controls over a period of timeCManagement's written assertion at a single point in timeDExistence of policies documented at a single point in time

• Compliance · 2 of 3

  Incident Response Planning

  A vendor that processes personal records on a company's behalf discovers a breach. Under GDPR Article 33, which party is responsible for notifying the supervisory authority?

  ABoth parties, jointlyBThe data controllerCEach party's DPODThe data processor

• Compliance · 3 of 3

  Privacy by Design

  A new ML feature uses historical user data without revisiting consent assumptions. What is needed?

  APurpose compatibility and lawful basis reassessment before reuseBTechnical privacy review by the engineering team during implementationCUser notification via email about the new feature using their dataDFeature flag rollout limiting exposure to a small user percentage first