Which statement best describes GDPR and the Trusted Agent's responsibilities in handling personal data?

• A. GDPR protects the personal data of EU residents, and the Trusted Agent ensures lawful processing, supports data subject rights, and enforces data minimization.
• B. GDPR applies only to financial data, and the Trusted Agent manages encryption keys.
• C. GDPR is primarily about network security, and the Trusted Agent builds malware defenses.
• D. GDPR sets payment card standards, and the Trusted Agent ensures PCI-DSS compliance.

Answer: (A)

GDPR governs how personal data of individuals in the EU is processed and protected. The Trusted Agent’s responsibilities fit this framework by ensuring that processing is lawful, supports data subject rights, and follows data minimization. That means handling data only when there is a valid basis (such as consent, contract, legal obligation, vital interests, public task, or legitimate interests), being transparent with individuals about how their data is used, and actively enabling rights like access, correction, erasure, restriction, data portability, and objections. It also means collecting only what is necessary for a stated purpose and keeping data for no longer than needed, while implementing safeguards to protect confidentiality and integrity and documenting processing activities.

Other options misstate GDPR’s focus or scope. It’s not limited to financial data, not primarily about network security, and it’s not about payment card standards or PCI-DSS compliance.