I85PREP
⌘ K
CEICC study materials
CEICC study resources

CEICC practice questions

One question at a time. Build your CEICC understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Compliance Frameworks and Regulatory Landscape

Which type of law is created by a legislature through a formal enactment process?

  1. Common law
  2. Statutory law Correct answer.
  3. Customary law
  4. Equity law

Explanation

Statutory law is written law enacted by a legislative body such as a parliament or congress. It is distinguished from judge-made common law and from informal customary practices.

Question 2Compliance Frameworks and Regulatory Landscape

A compliance officer is mapping which regulator supervises a bank's prudential soundness. Which type of authority is primarily responsible for prudential supervision?

  1. A consumer protection agency
  2. A financial supervisory authority Correct answer.
  3. A competition commission
  4. A data protection authority

Explanation

Prudential supervision of banks concerns capital adequacy, liquidity, and overall safety and soundness, which is the mandate of a financial supervisory authority. Consumer, data, and competition regulators have different statutory objectives.

Question 3Compliance Frameworks and Regulatory Landscape

What is the primary purpose of a compliance framework within a regulated firm?

  1. To structure controls that keep the firm within legal and regulatory obligations Correct answer.
  2. To replace the firm's internal audit function
  3. To transfer regulatory liability to individual employees
  4. To guarantee that the firm earns maximum profit

Explanation

A compliance framework organizes policies, procedures, controls, and monitoring so the firm can identify and meet its regulatory obligations. It supports but does not replace audit, and it does not shift regulatory responsibility away from the firm.

Question 4Compliance Frameworks and Regulatory Landscape

Which concept holds that a person should not be punished under a law that did not exist at the time the conduct occurred?

  1. Nulla poena sine lege Correct answer.
  2. Due process
  3. Res judicata
  4. Stare decisis

Explanation

Nulla poena sine lege means no punishment without law, requiring that prohibited conduct be defined by law before it occurs. It protects against retroactive criminal liability.

Question 5Compliance Frameworks and Regulatory Landscape

A regulation states that firms 'must take reasonable steps' to prevent misconduct but does not prescribe specific controls. How should a compliance team treat this requirement?

  1. Apply only the minimum effort needed to document a policy
  2. Ignore it because it is not enforceable
  3. Wait for the regulator to issue a detailed rule before acting
  4. Design proportionate controls and be able to evidence their reasonableness Correct answer.

Explanation

Principles-based requirements oblige firms to exercise judgment and implement proportionate measures that can be evidenced as reasonable. Regulators expect firms to translate the principle into concrete, documented controls.

Question 6Compliance Frameworks and Regulatory Landscape

Which of the following best describes the role of a regulator's supervisory review process?

  1. Setting monetary policy interest rates
  2. Prosecuting individuals for criminal offences
  3. Assessing a firm's compliance with rules and requiring remediation where gaps exist Correct answer.
  4. Auditing the firm's financial statements for shareholders

Explanation

Supervisory review evaluates whether a firm meets regulatory requirements and directs remedial action for deficiencies. Criminal prosecution, monetary policy, and shareholder audit are functions of other bodies.

Question 7Compliance Frameworks and Regulatory Landscape

A firm operates across several jurisdictions and faces conflicting local rules. Which approach best reflects sound regulatory compliance practice?

  1. Apply the rule of the headquarters country only
  2. Identify the strictest applicable requirement and adopt controls that satisfy all jurisdictions Correct answer.
  3. Apply the least stringent rule everywhere to reduce cost
  4. Choose rules at random per business line

Explanation

When rules conflict across jurisdictions, a common practice is to adopt controls meeting the highest applicable standard so that all local requirements are satisfied. This avoids regulatory breaches in any single market.

Question 8Compliance Frameworks and Regulatory Landscape

What does the term 'regulatory perimeter' refer to?

  1. The set of activities, entities, or products that fall within a regulator's remit Correct answer.
  2. The internal budget of a supervisory authority
  3. The geographic boundary of a regulator's office
  4. The maximum fine a regulator may impose

Explanation

The regulatory perimeter defines which activities, entities, and products a regulator supervises. Activities outside the perimeter may be unregulated or supervised by a different authority.

Question 9Compliance Frameworks and Regulatory Landscape

Which document typically sets out a regulator's legal powers, objectives, and the entities it supervises?

  1. An industry trade association charter
  2. A stock exchange listing agreement
  3. The regulator's founding statute or enabling legislation Correct answer.
  4. The firm's internal code of conduct

Explanation

A regulator's authority derives from its enabling statute, which defines its objectives, powers, and jurisdictional scope. Internal codes and industry charters do not confer statutory authority.

Question 10Compliance Frameworks and Regulatory Landscape

A compliance analyst is asked to classify a new product to determine whether it triggers licensing requirements. What is the most appropriate first step?

  1. Launch the product and monitor for regulatory reaction
  2. Compare the product's features against the legal definitions of regulated activities Correct answer.
  3. Assume the product is unregulated unless told otherwise
  4. Ask a competitor how they classified a similar product

Explanation

Classification requires mapping the product's characteristics to the statutory definitions of regulated activities. This determines whether licensing or other obligations apply before launch.

Question 11Compliance Frameworks and Regulatory Landscape

Which principle requires that regulations be clear, accessible, and applied predictably to those subject to them?

  1. Subsidiarity
  2. Proportionality
  3. Legal certainty Correct answer.
  4. Confidentiality

Explanation

Legal certainty holds that rules should be clear, knowable in advance, and applied consistently so parties can order their affairs. Proportionality concerns the fit between measures and objectives.

Question 12Compliance Frameworks and Regulatory Landscape

A regulator issues guidance that is not legally binding but sets out expected practice. What is the compliance implication for a firm?

  1. The firm should generally follow it, as departure may need to be justified to the regulator Correct answer.
  2. The firm must follow it exactly as if it were statute
  3. The firm may ignore it because it is non-binding
  4. The firm should follow it only if a competitor does

Explanation

Non-binding guidance expresses the regulator's expectations; firms that depart from it may be asked to justify their approach and face heightened scrutiny. It is not statute, but it strongly shapes supervisory expectations.

Question 13Compliance Frameworks and Regulatory Landscape

Which of the following is a typical enforcement tool available to a financial regulator?

  1. Granting judicial injunctions
  2. Imposing administrative fines Correct answer.
  3. Setting criminal sentencing guidelines
  4. Issuing arrest warrants for executives

Explanation

Financial regulators commonly impose administrative fines, restrictions, or other sanctions for rule breaches. Arrest warrants, sentencing guidelines, and injunctions are functions of courts or other authorities.

Question 14Compliance Frameworks and Regulatory Landscape

What is the main function of an anti-money laundering (AML) legal framework?

  1. Guaranteeing investment returns for customers
  2. Requiring identification, monitoring, and reporting to detect and deter illicit finance Correct answer.
  3. Setting the interest rates banks charge
  4. Standardizing accounting treatments across firms

Explanation

AML frameworks impose customer due diligence, transaction monitoring, and suspicious activity reporting to detect and deter money laundering. They do not address returns, interest rates, or accounting standards.

Question 15Compliance Frameworks and Regulatory Landscape

A firm discovers a new regulation that takes effect in six months and requires system changes. What is the most appropriate compliance response?

  1. Begin an impact assessment and implementation plan before the effective date Correct answer.
  2. Request an indefinite exemption from the regulator
  3. Delegate the matter to the IT department alone
  4. Wait until the effective date to assess impact

Explanation

Sound practice is to assess the impact and plan implementation ahead of the effective date so the firm is compliant when the rule takes effect. Waiting or delegating narrowly risks non-compliance at the deadline.

Question 16Compliance Frameworks and Regulatory Landscape

Which statement best describes the relationship between a regulation and a directive in a legal system that uses both instruments?

  1. A directive is directly applicable, while a regulation requires transposition
  2. Neither has binding legal effect
  3. Both are identical in legal effect
  4. A regulation is directly applicable, while a directive must be transposed into national law Correct answer.

Explanation

In systems such as the EU, a regulation applies directly in member states, whereas a directive sets objectives that member states must implement through national legislation. Their legal mechanics differ even when covering similar subject matter.

Question 17Compliance Frameworks and Regulatory Landscape

A compliance team wants to demonstrate that its framework is effective to the board. Which evidence is most persuasive?

  1. The number of policies the firm has written
  2. A statement that no breaches have been reported
  3. Documented testing, monitoring results, and remediation of identified issues Correct answer.
  4. The seniority of the compliance officer

Explanation

Effectiveness is demonstrated through evidence of testing, monitoring outcomes, and closure of issues. Absence of reported breaches, policy volume, or staff seniority do not by themselves show the framework works.

Question 18Compliance Frameworks and Regulatory Landscape

What is the purpose of a regulatory sandbox?

  1. To exempt firms permanently from all regulation
  2. To provide tax relief to financial firms
  3. To allow controlled testing of innovative products under regulator oversight with tailored conditions Correct answer.
  4. To replace licensing requirements with self-certification

Explanation

A sandbox lets firms test innovations in a controlled environment with appropriate safeguards and regulator engagement. It is time-limited and does not remove the need for eventual authorization.

Question 19Compliance Frameworks and Regulatory Landscape

Which of the following best characterizes 'conduct risk' regulation?

  1. Ensuring banks hold sufficient capital buffers
  2. Setting minimum liquidity ratios
  3. Focusing on fair treatment of customers and market integrity Correct answer.
  4. Regulating the physical security of bank branches

Explanation

Conduct regulation addresses how firms behave toward customers and markets, including fairness and integrity. Capital and liquidity requirements are prudential matters.

Question 20Compliance Frameworks and Regulatory Landscape

A firm's compliance officer learns that a senior manager has bypassed a required approval control. What is the most appropriate action under a sound compliance framework?

  1. Take no action because of the manager's seniority
  2. Discuss it informally and leave no record
  3. Escalate through the appropriate governance channel and document the breach Correct answer.
  4. Quietly adjust the records to show approval occurred

Explanation

Breaches of controls, regardless of seniority, should be escalated through governance channels and documented so they can be addressed. Concealment or inaction undermines the framework and may itself violate obligations.

Question 21Compliance Frameworks and Regulatory Landscape

Which concept describes the principle that a regulator should only take action that is necessary and no more restrictive than needed to achieve its objective?

  1. Transparency
  2. Accountability
  3. Independence
  4. Proportionality Correct answer.

Explanation

Proportionality requires that regulatory measures be suitable and not exceed what is necessary to achieve the legitimate objective. Transparency and accountability concern openness and answerability, while independence concerns freedom from undue influence.

Question 22Compliance Frameworks and Regulatory Landscape

A multinational firm must report suspicious transactions in multiple countries. Which approach best supports consistent compliance?

  1. Use a single global report that ignores local filing deadlines
  2. Report only in the country with the largest revenue
  3. Report only when a customer requests it
  4. Maintain a coordinated process that meets each jurisdiction's reporting requirements Correct answer.

Explanation

Suspicious activity reporting obligations are jurisdiction-specific, so a coordinated process must satisfy each local requirement, including timing and format. Selective or customer-driven reporting would breach local rules.

Question 23Compliance Frameworks and Regulatory Landscape

What is the primary function of a data protection authority?

  1. Setting competition policy
  2. Regulating securities listings
  3. Supervising bank capital adequacy
  4. Enforcing privacy laws and overseeing processing of personal data Correct answer.

Explanation

A data protection authority enforces privacy legislation and oversees how organizations process personal data. Capital, securities, and competition oversight belong to other regulators.

Question 24Compliance Frameworks and Regulatory Landscape

A new regulation requires firms to retain records for a specified period. A firm's existing policy retains records for a shorter period. What should the firm do?

  1. Retain records only when a customer asks
  2. Update its retention policy and systems to meet the longer required period Correct answer.
  3. Destroy records at the old interval and rely on backups
  4. Keep the shorter period because it is already documented

Explanation

Where a regulatory retention period exceeds internal policy, the firm must align its policy and systems to the legal minimum. Continuing the shorter period would breach the retention requirement.

Question 25Compliance Frameworks and Regulatory Landscape

Which statement best explains why regulators require firms to maintain a compliance risk assessment?

  1. To replace the need for internal policies
  2. To eliminate all compliance risk entirely
  3. To satisfy marketing disclosure obligations
  4. To rank risks so controls and monitoring can be directed proportionately Correct answer.

Explanation

A compliance risk assessment identifies and prioritizes risks so that controls and monitoring resources can be allocated proportionately. It does not eliminate risk and does not substitute for policies.

Question 26Compliance Frameworks and Regulatory Landscape

Which body of rules issued by a regulator typically has binding legal force on the firms it supervises?

  1. Supervisory letters
  2. Consultation papers
  3. Formal rules and regulations Correct answer.
  4. Industry codes of conduct

Explanation

Formal rules and regulations are adopted under statutory authority and carry binding legal effect on the entities within the regulator's scope. Consultation papers and most supervisory communications set expectations or invite comment rather than create enforceable obligations.

Question 27Compliance Frameworks and Regulatory Landscape

A firm identifies that a new regulation will require changes to its onboarding process. Which action best demonstrates a structured compliance framework response?

  1. Delegating the matter to the front office without documentation
  2. Mapping the requirement to controls and assigning owners with deadlines Correct answer.
  3. Adding the requirement to a generic training module only
  4. Waiting until the effective date to assess impact

Explanation

A structured response translates the obligation into specific controls, owners, and timelines so implementation can be tracked and evidenced. Simply training staff or acting at the deadline leaves the gap unmanaged until it becomes a breach.

Question 28Compliance Frameworks and Regulatory Landscape

Which concept describes the principle that a person should not be punished under a rule that did not exist at the time of the conduct?

  1. Due process
  2. Proportionality
  3. Legitimate expectation
  4. Non-retroactivity Correct answer.

Explanation

Non-retroactivity means rules apply prospectively and cannot criminalize or penalize conduct that was lawful when it occurred. Proportionality concerns the fit between sanction and breach, and legitimate expectation concerns reliance on prior representations.

Question 29Compliance Frameworks and Regulatory Landscape

A firm's compliance function reports to the board that its control framework is operating effectively. Which governance arrangement best supports independent oversight of that framework?

  1. The compliance head reports directly to the sales director
  2. The compliance head reports to the CEO with no board access
  3. The compliance head is also the head of front-office trading
  4. The compliance head reports to the audit committee or a non-executive body Correct answer.

Explanation

Independence is preserved when compliance has a reporting line to a non-executive or audit committee that can challenge management without conflict. Reporting into revenue-generating functions or combining compliance with business roles compromises objectivity.

Question 30Compliance Frameworks and Regulatory Landscape

Which statement best describes the function of a regulatory register or licensing list maintained by a supervisor?

  1. It lists all complaints filed against authorized firms
  2. It sets the maximum fees a firm may charge customers
  3. It records which entities are authorized to carry on specified regulated activities Correct answer.
  4. It publishes the personal tax records of senior managers

Explanation

Authorization registers identify which entities are permitted to conduct specified regulated activities, allowing the public and counterparties to verify status. Registers do not set commercial pricing or publish personal tax data.

Question 31Compliance Frameworks and Regulatory Landscape

A regulator publishes a thematic review finding that several firms have weak complaint-handling records. How should a firm that was not reviewed respond?

  1. Disclose the findings to customers as a warning about competitors
  2. Assess its own complaint processes against the findings and remediate gaps Correct answer.
  3. Ignore the findings because they apply only to reviewed firms
  4. Wait for a formal enforcement action before changing anything

Explanation

Thematic findings signal supervisory priorities and expected standards across the market, so firms should self-assess against them even if not directly reviewed. Ignoring them increases the risk of later enforcement when the same weakness is found.

Question 32Compliance Frameworks and Regulatory Landscape

Which mechanism allows a regulator to obtain information from a firm during an investigation without first bringing formal proceedings?

  1. A press release
  2. A licensing application
  3. A statutory information request Correct answer.
  4. A public consultation

Explanation

Statutory information requests give the regulator a legal power to compel documents or explanations as part of supervision or investigation. Consultations, press releases, and licensing applications are not information-gathering tools.

Question 33Compliance Frameworks and Regulatory Landscape

Which framework element is most directly designed to ensure that employees understand and can apply the firm's obligations in their daily work?

  1. A targeted compliance training programme Correct answer.
  2. A dividend distribution policy
  3. A capital adequacy buffer
  4. A customer satisfaction survey

Explanation

Targeted training translates regulatory and policy obligations into role-specific behaviors so staff can recognize and handle compliance issues. Capital buffers and dividend policies address financial resilience, not staff understanding.

Question 34Compliance Frameworks and Regulatory Landscape

A firm operates in a jurisdiction where a local rule conflicts with a stricter group-wide standard. Which approach best reflects a sound compliance framework?

  1. Ask staff to choose the standard they prefer case by case
  2. Apply whichever standard is cheaper to implement
  3. Apply the local rule only, since it is legally binding
  4. Apply the stricter standard where it does not breach local law Correct answer.

Explanation

A well-designed framework applies the higher of local and group standards where doing so remains lawful, preserving consistency and reducing cross-border risk. Applying only the local minimum can breach group policy and create inconsistent controls.

Question 35Compliance Frameworks and Regulatory Landscape

Which statement best describes the purpose of a regulator's enforcement policy?

  1. It guarantees that no enforcement action will be taken if a firm self-reports
  2. It sets the salaries of the regulator's senior staff
  3. It explains how the regulator will investigate, sanction, and prioritize breaches Correct answer.
  4. It replaces the underlying legislation with case-by-case discretion

Explanation

An enforcement policy describes the regulator's approach to identifying, investigating, and sanctioning breaches, including how it prioritizes cases. It operates within the legislation and does not override it or guarantee immunity.

Question 36Compliance Frameworks and Regulatory Landscape

A regulator requires firms to submit periodic regulatory returns. Which control is most important to ensure the accuracy of those submissions?

  1. Allowing each business unit to submit its own version
  2. Reconciling reported figures to source systems and obtaining sign-off Correct answer.
  3. Submitting returns as early as possible each period
  4. Storing returns only in a shared inbox without review

Explanation

Accuracy depends on reconciling reported data to underlying records and having authorized sign-off before submission. Speed, multiple uncoordinated versions, and unreviewed storage all increase the risk of misstatement.

Question 37International Data Protection and Privacy Law

Under the GDPR, which body is the primary independent public authority established by each Member State to supervise the application of the Regulation?

  1. The European Commission
  2. The supervisory authority Correct answer.
  3. The European Data Protection Board
  4. The Council of Europe

Explanation

Each Member State must establish one or more independent supervisory authorities responsible for monitoring and enforcing the GDPR within its territory. The European Data Protection Board is an EU-level coordinating body, not a national authority.

Question 38International Data Protection and Privacy Law

What does the principle of 'purpose limitation' in the GDPR require?

  1. Controllers must obtain written consent for every processing activity
  2. Personal data must be collected for specified, explicit and legitimate purposes and not further processed incompatibly Correct answer.
  3. Data must be deleted as soon as the purpose is documented
  4. Data must be stored only in the country where it was collected

Explanation

Purpose limitation, set out in Article 5(1)(b), confines collection to specified, explicit and legitimate purposes and prohibits incompatible further processing. Compatible further processing (for example archiving in the public interest) remains permissible.

Question 39International Data Protection and Privacy Law

Which legal instrument is the Council of Europe convention on data protection that predates the GDPR and has been modernised?

  1. Convention 108+ Correct answer.
  2. The Budapest Convention
  3. The Schengen Agreement
  4. The Hague Convention

Explanation

Convention 108 (1981) is the Council of Europe's data protection convention, and its modernised version is known as Convention 108+. It applies beyond the EU and influenced later EU law.

Question 40International Data Protection and Privacy Law

A company processes personal data on the basis of the data subject's consent. Under the GDPR, which statement describes a valid consent?

  1. It must be a freely given, specific, informed and unambiguous indication of the data subject's wishes Correct answer.
  2. It must be bundled into the general terms of service for simplicity
  3. It may be inferred from the data subject's silence
  4. It must always be in notarised written form

Explanation

Article 4(11) defines consent as a freely given, specific, informed and unambiguous indication of wishes, expressed by statement or clear affirmative action. Silence or pre-ticked boxes do not constitute consent.

Question 41International Data Protection and Privacy Law

Under the GDPR, within what period must a controller generally notify a personal data breach to the competent supervisory authority?

  1. Within 30 days of becoming aware
  2. Within 72 hours of becoming aware Correct answer.
  3. Only at the end of the calendar year
  4. Within 24 hours of becoming aware

Explanation

Article 33 requires notification to the supervisory authority without undue delay and, where feasible, no later than 72 hours after the controller becomes aware of the breach, unless it is unlikely to result in a risk.

Question 42International Data Protection and Privacy Law

Which of the following best describes the role of a data processor under the GDPR?

  1. It processes personal data on behalf of and under the instructions of a controller Correct answer.
  2. It determines the purposes and means of processing
  3. It independently decides the lawful basis for processing
  4. It is always a public authority

Explanation

A processor handles personal data on behalf of a controller and must act on the controller's documented instructions. The controller, not the processor, determines purposes and means.

Question 43International Data Protection and Privacy Law

Which right allows a data subject to receive their personal data in a structured, commonly used and machine-readable format and to transmit it to another controller?

  1. The right to object
  2. The right to restriction of processing
  3. The right to rectification
  4. The right to data portability Correct answer.

Explanation

Article 20 grants the right to data portability, enabling data subjects to receive and reuse their data across services. Rectification, restriction and objection address other aspects of data control.

Question 44International Data Protection and Privacy Law

What is the main purpose of a Data Protection Impact Assessment (DPIA) under the GDPR?

  1. To identify and mitigate risks to data subjects arising from high-risk processing Correct answer.
  2. To obtain consent from data subjects
  3. To calculate the financial penalties a controller may face
  4. To register the controller with the supervisory authority

Explanation

Article 35 requires a DPIA where processing is likely to result in a high risk to rights and freedoms, so that risks can be assessed and mitigation measures identified. It is a risk-management tool, not a registration or consent mechanism.

Question 45International Data Protection and Privacy Law

A German online retailer uses a French marketing agency to send promotional emails to customers in France. The agency only follows the retailer's written instructions. Which party is the controller?

  1. Both parties are joint controllers in all respects
  2. The French marketing agency
  3. Neither party, because the customers are in France
  4. The German online retailer Correct answer.

Explanation

The retailer determines the purposes and means of the processing and is therefore the controller; the agency acts on its instructions as a processor. Location of the data subjects does not change this allocation.

Question 46International Data Protection and Privacy Law

A Spanish company wants to transfer personal data to a processor in a country without an adequacy decision. Which mechanism can it rely on to make the transfer lawful under the GDPR?

  1. The data subject's general familiarity with the company
  2. An internal memo filed only with the company's board
  3. A verbal promise from the recipient
  4. Standard contractual clauses approved by the European Commission Correct answer.

Explanation

Article 46 permits transfers subject to appropriate safeguards, including standard contractual clauses adopted by the Commission. Informal promises or internal memos do not provide the required safeguards.

Question 47International Data Protection and Privacy Law

Which GDPR article establishes the principle of accountability, requiring the controller to be able to demonstrate compliance?

  1. Article 5(2) Correct answer.
  2. Article 17
  3. Article 33
  4. Article 44

Explanation

Article 5(2) makes the controller responsible for, and able to demonstrate, compliance with the data protection principles. This accountability principle underpins records, policies and assessments.

Question 48International Data Protection and Privacy Law

Under the GDPR, a data subject asks a controller to erase their data. In which situation may the controller refuse the request?

  1. When processing is necessary for compliance with a legal obligation Correct answer.
  2. When the data was collected more than one year ago
  3. When the data subject has not provided a reason
  4. When the data subject simply prefers not to keep the data

Explanation

Article 17(3) lists exceptions to erasure, including where processing is necessary for compliance with a legal obligation or for the establishment, exercise or defence of legal claims. Mere preference or age of data does not justify refusal.

Question 49International Data Protection and Privacy Law

What does the 'one-stop-shop' mechanism in the GDPR provide for cross-border processing?

  1. It removes the need for any supervisory authority oversight
  2. It applies only to controllers based outside the EU
  3. It designates a lead supervisory authority for a controller's main establishment to coordinate cross-border matters Correct answer.
  4. It allows data subjects to file complaints in any country without any rules

Explanation

The one-stop-shop, in Article 56, designates the supervisory authority of the controller's main establishment as lead authority for cross-border processing, coordinating with other concerned authorities. It does not eliminate oversight or restrict itself to non-EU controllers.

Question 50International Data Protection and Privacy Law

Which of the following is a 'special category' of personal data under Article 9 of the GDPR?

  1. Data revealing racial or ethnic origin Correct answer.
  2. A person's postal address
  3. A company's registration number
  4. A public product review

Explanation

Article 9 treats data revealing racial or ethnic origin, among other sensitive categories such as health and religion, as special category data subject to stricter conditions. Ordinary contact details and business identifiers are not special category data.