Exam CIPP-A topic 1 question 58 discussion

Section 43A and the 2011 Rules 3-8 Rule 6: Disclosure Limitations and Exceptions  SPI only: Disclosure of sensitive personal data or information by body corporate to any third party shall require prior permission from the provider of such information, who has provided such information under lawful contract or otherwise, unless such disclosure has been agreed to in the contract between the body corporate and provider of information, or where the disclosure is necessary for compliance of a legal obligation.  Companies prohibited from “publishing” SPI.  Third parties receiving SPI shall not disclose it further.  EXCEPTION: Disclosure permitted to govt agencies mandated by law to obtain info (including SPI) for verification of ID, prevention, detection, investigation of cyber incidents, prosecution, punishment.  No disclosure rights for data subject if data subject is not also provider.

Should be B - disclosure limitation. Disclosure limitation (Rule 6 of the IT rules) is an essential aspect of data protection and privacy regulations. It involves restricting the amount of sensitive information that can be accessed or disclosed to third parties without proper authorization. This principle is particularly important in the context of data export to ensure that personal data is adequately protected during transfer.