Which concept relates to legal obligations for protecting data?

• A. Data Backups
• B. Industry Regulations
• C. Sensitivity Label
• D. Domain Type Enforcement (DTE)

Answer: (B)

Legal obligations for protecting data come from regulatory requirements that tell organizations how they must safeguard information. Industry regulations like GDPR, HIPAA, PCI DSS, and similar frameworks set the rules for data protection, covering areas such as access controls, encryption, data minimization, breach notification, retention, and auditability. Understanding these obligations helps you see why certain security controls are required across identity and access management, since the goal is to meet the legal standards for protecting personal and sensitive data.

Data backups, while essential for recovery and resilience, aren’t in themselves the legal obligation to protect data. They support compliance by ensuring data can be restored after loss, but they don’t define the overarching requirements for data protection. Sensitivity labels are about classifying data to apply appropriate protections; they help enforce policies but don’t in themselves describe the legal duties organizations have to protect data. Domain Type Enforcement is a technical access-control mechanism used to enforce security policies at the system level, not about meeting regulatory obligations.