ISC2 Systems Security Certified Practitioner (SSCP) Practice Question

Because the logs contain IP addresses and email addresses, they include personal data under the GDPR. Moving that data from the EU to a third country requires a valid transfer mechanism under Chapter V. Although some U.S. organizations benefit from the EU-US Data Privacy Framework adequacy decision, the specific recipient in this scenario is not certified. Therefore, the transfer is considered restricted and the controller must implement an alternative mechanism-such as Standard Contractual Clauses, Binding Corporate Rules, or another approved safeguard-before the data can leave the EU. The GDPR does not impose a universal 30-day log-retention limit, does not treat IP addresses as special-category data, and does not always require explicit consent when another lawful basis (e.g., legitimate interest) applies. Ensuring an appropriate cross-border transfer mechanism is the primary legal requirement that must be satisfied.