Question

A penetration testing firm based in the United States is contracted to test a web application for a client headquartered in Germany. During pre-engagement scoping, the tester discovers the application processes personal data of EU residents, and captured test artifacts may include this data. What is the MOST important legal consideration the tester must address before beginning the engagement?

Accepted Answer

Ensure the rules of engagement specify GDPR-compliant handling, storage, and cross-border transfer requirements for any personal data encountered

Answer

Confirm that the testing window falls within German business hours to avoid disrupting operations

Answer

Require the client to obtain PCI DSS certification before the assessment can proceed

Answer

Limit the assessment to a black-box methodology so no personal data is ever accessed