ISC2 Certified Cloud Security Professional (CCSP) Practice Question

Contractual private data is protected primarily through agreements between parties; if it is disclosed, the primary recourse is a breach-of-contract claim. Examples include trade secrets, proprietary business plans, and intellectual property that are not specifically governed by privacy statutes. In contrast, regulated private data-such as protected health information (PHI) under HIPAA or personally identifiable information (PII) like Social Security numbers-is subject to statutory or regulatory mandates that impose specific handling, breach-notification, and protection requirements.

Dataset 1 (proprietary source code under NDA) fits the definition of contractual private data: its confidentiality is enforced through contract, and no dedicated privacy law dictates how it must be protected. Datasets 2 and 3 both contain regulated data-PHI and sensitive PII respectively-subject to U.S. laws such as HIPAA and state breach-notification statutes. Dataset 4, although anonymized, no longer qualifies as personal data only because re-identification is not reasonably possible; therefore, it falls outside privacy regulations, but it is not 'private data' in the contractual sense described in the scenario. Thus, the dataset best classified as contractual private data is the proprietary source code under NDA.