I85PREP
⌘ K
DAPLE (C1) study materials
DAPLE (C1) study resources

DAPLE (C1) practice questions

One question at a time. Build your DAPLE (C1) understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Data Protection Law and Regulatory Frameworks

Under the GDPR, which lawful basis requires a freely given, specific, informed and unambiguous indication of the data subject's wishes?

  1. Consent Correct answer.
  2. Performance of a contract
  3. Legitimate interests
  4. Legal obligation

Explanation

Article 4(11) GDPR defines consent as any freely given, specific, informed and unambiguous indication of the data subject's wishes by which they signify agreement to processing. The other bases are established by facts or law rather than by an indication of wishes. Consent must also be withdrawable at any time under Article 7(3).

Question 2Data Protection Law and Regulatory Frameworks

Which principle of the GDPR limits processing to what is adequate, relevant and limited to what is necessary in relation to the purposes?

  1. Integrity and confidentiality
  2. Data minimisation Correct answer.
  3. Accountability
  4. Storage limitation

Explanation

Article 5(1)(c) GDPR embodies data minimisation: personal data must be adequate, relevant and limited to what is necessary for the purposes. Storage limitation concerns retention periods, while integrity and confidentiality concerns security. Accountability requires the controller to demonstrate compliance with all principles.

Question 3Data Protection Law and Regulatory Frameworks

A company wants to appoint a Data Protection Officer. According to the GDPR, which attribute is decisive for the DPO's role?

  1. Membership of the company's supervisory board
  2. Professional qualities and expert knowledge of data protection law and practice Correct answer.
  3. Holding a senior marketing position within the controller
  4. Being the controller's external legal counsel

Explanation

Article 37(5) GDPR requires the DPO to be designated on the basis of professional qualities and, in particular, expert knowledge of data protection law and practice. Article 38(6) further prohibits dismissing or penalising the DPO for performing the role. Independence from conflicting duties is essential, which excludes marketing leadership and external counsel roles.

Question 4Data Protection Law and Regulatory Frameworks

Which GDPR right allows a data subject to receive their personal data in a structured, commonly used and machine-readable format and to transmit it to another controller?

  1. Right to data portability Correct answer.
  2. Right to restriction of processing
  3. Right to erasure
  4. Right of access

Explanation

Article 20 GDPR establishes the right to data portability, requiring provision of data in a structured, commonly used and machine-readable format and, where technically feasible, direct transmission between controllers. It applies to processing based on consent or contract and carried out by automated means. The right of access, by contrast, provides a copy but not portability.

Question 5Data Protection Law and Regulatory Frameworks

A controller based in Germany processes personal data through an establishment in France and offers services to individuals in Spain. Which supervisory authority is competent as lead authority under the one-stop-shop mechanism?

  1. The European Data Protection Board, as coordinator of cross-border cases
  2. The German supervisory authority, as the location of the controller's registered office
  3. The French supervisory authority, as the location of the main establishment Correct answer.
  4. The Spanish supervisory authority, as the location of the affected data subjects

Explanation

Under Article 56 GDPR, the supervisory authority of the main establishment is the lead authority for cross-border processing. The main establishment is determined by where decisions on the purposes and means of processing are taken, which here is France. The location of the registered office or of data subjects is not decisive when the main establishment is elsewhere.

Question 6Data Protection Law and Regulatory Frameworks

Under the GDPR, within what period must a controller generally respond to a data subject access request?

  1. Two months from receipt, extendable by one further month
  2. Fourteen days from receipt, with no possibility of extension
  3. One month from receipt, extendable by two further months for complex requests Correct answer.
  4. Three months from receipt, with no possibility of extension

Explanation

Article 12(3) GDPR requires the controller to provide information on action taken without undue delay and in any event within one month of receipt. That period may be extended by two further months where requests are complex or numerous, with notification to the data subject. The initial one-month period runs from receipt of the request.

Question 7Data Protection Law and Regulatory Frameworks

Which instrument replaced the EU Data Protection Directive 95/46/EC and became directly applicable in all Member States?

  1. Regulation (EU) 2016/679 Correct answer.
  2. Directive (EU) 2016/680
  3. Convention 108+
  4. Regulation (EU) 2018/1725

Explanation

Regulation (EU) 2016/679, the GDPR, repealed Directive 95/46/EC and applies directly without national transposition. Directive 2016/680 governs processing by competent authorities for law enforcement purposes. Regulation 2018/1725 applies to EU institutions, bodies and agencies.

Question 8Data Protection Law and Regulatory Frameworks

A controller relies on legitimate interests as its lawful basis. Which condition must be satisfied in addition to identifying a legitimate interest?

  1. The processing must involve a special category of personal data
  2. The data subject must have given explicit consent to the processing
  3. The processing must be necessary to comply with a legal obligation
  4. The interests must not be overridden by the data subject's interests, rights or freedoms Correct answer.

Explanation

Article 6(1)(f) GDPR requires a three-part test: a legitimate interest, necessity of processing, and a balancing exercise showing that the data subject's interests, rights or freedoms do not override the controller's interests. Consent and legal obligation are separate lawful bases. Special category data requires an additional Article 9 condition.

Question 9Data Protection Law and Regulatory Frameworks

Which of the following is a special category of personal data under Article 9 GDPR?

  1. Employment history
  2. Bank account number
  3. Genetic data Correct answer.
  4. Contact details

Explanation

Article 9(1) GDPR lists special categories including racial or ethnic origin, political opinions, religious beliefs, health data, and genetic and biometric data. Contact details, employment history and bank account numbers are ordinary personal data. Processing special category data is prohibited unless an Article 9(2) exception applies.

Question 10Data Protection Law and Regulatory Frameworks

A controller discovers a personal data breach that is likely to result in a risk to the rights and freedoms of individuals. To which authority and within what timeframe must it be notified under the GDPR?

  1. The competent supervisory authority, without undue delay and where feasible within 72 hours of becoming aware Correct answer.
  2. The national cybersecurity agency, within 24 hours of becoming aware
  3. The affected data subjects only, within 72 hours of becoming aware
  4. The European Data Protection Board, within 30 days of becoming aware

Explanation

Article 33(1) GDPR requires notification to the competent supervisory authority without undue delay and, where feasible, not later than 72 hours after the controller becomes aware of the breach. Notification to data subjects is a separate obligation under Article 34 where there is a high risk. The EDPB is not a notification recipient in individual cases.

Question 11Data Protection Law and Regulatory Frameworks

Which transfer mechanism under the GDPR requires an assessment of whether the third country ensures an essentially equivalent level of protection?

  1. A certification under Article 46
  2. An adequacy decision
  3. A binding corporate rule approved by the competent authority
  4. Standard contractual clauses Correct answer.

Explanation

Following Schrems II, transfers relying on Article 46 tools such as standard contractual clauses require a transfer impact assessment examining the laws and practices of the recipient country. An adequacy decision is adopted by the Commission after its own assessment and requires no case-by-case analysis. Certifications and binding corporate rules are also Article 46 tools but the question targets the transfer impact assessment obligation attached to SCCs.

Question 12Data Protection Law and Regulatory Frameworks

What is the maximum administrative fine the GDPR permits for the most serious infringements?

  1. 10 million euros or 2% of total worldwide annual turnover, whichever is higher
  2. 5 million euros or 1% of total worldwide annual turnover, whichever is higher
  3. 20 million euros or 4% of total worldwide annual turnover, whichever is higher Correct answer.
  4. 50 million euros or 5% of total worldwide annual turnover, whichever is higher

Explanation

Article 83(5) GDPR sets the upper tier at 20 million euros or 4% of total worldwide annual turnover of the preceding financial year, whichever is higher. The lower tier under Article 83(4) is 10 million euros or 2%. Fines must be effective, proportionate and dissuasive in each case.

Question 13Data Protection Law and Regulatory Frameworks

A controller engages a processor to handle payroll data. Which obligation does the GDPR place directly on the processor?

  1. Assisting the controller in ensuring compliance with security and breach notification duties Correct answer.
  2. Providing the privacy notice to employees
  3. Determining the purposes of the payroll processing
  4. Deciding the lawful basis for the payroll processing

Explanation

Article 28(3)(f) GDPR requires the processor to assist the controller in ensuring compliance with Articles 32 to 36, covering security, breach notification and impact assessments. Determining purposes and lawful bases remains the controller's responsibility under Article 4(7). The privacy notice is likewise a controller obligation.

Question 14Data Protection Law and Regulatory Frameworks

When is a data protection impact assessment mandatory under the GDPR?

  1. Whenever the controller employs more than 250 people
  2. Where a type of processing is likely to result in a high risk to the rights and freedoms of individuals Correct answer.
  3. Whenever any personal data is processed by a processor
  4. Whenever the processing involves data of customers located outside the EU

Explanation

Article 35(1) GDPR requires a DPIA where a type of processing, in particular using new technologies, is likely to result in a high risk to the rights and freedoms of natural persons. Article 35(3) lists examples such as systematic and extensive evaluation or large-scale special category processing. A DPIA is not triggered merely by using a processor or by headcount.

Question 15Data Protection Law and Regulatory Frameworks

Which body issues guidelines, recommendations and best practices to ensure consistent application of the GDPR across the Union?

  1. The European Data Protection Board Correct answer.
  2. The Court of Justice of the European Union
  3. The European Commission
  4. The European Ombudsman

Explanation

Article 70 GDPR tasks the European Data Protection Board with issuing guidelines, recommendations and best practices for consistent application of the Regulation. The Commission may adopt implementing acts but does not issue EDPB guidance. The Court interprets the law through judgments, and the Ombudsman handles maladministration complaints.

Question 16Data Protection Law and Regulatory Frameworks

A UK organisation processes personal data of individuals in the EU in the context of offering goods or services. Which data protection regime applies to that processing in addition to the UK GDPR?

  1. The EU GDPR only if the individuals have expressly consented
  2. No EU regime applies because the UK has an adequacy decision
  3. The EU GDPR, because the processing falls within the territorial scope of Article 3(2) Correct answer.
  4. Only the UK GDPR, because the controller is established in the UK

Explanation

Article 3(2) GDPR applies to controllers not established in the Union that offer goods or services to data subjects in the Union. The UK's adequacy decision permits free data flows but does not remove the extraterritorial reach of the EU GDPR. Consent is not the test for territorial scope.

Question 17Data Protection Law and Regulatory Frameworks

Which requirement applies to a valid consent request directed at a child in relation to information society services under the GDPR?

  1. Consent must be given by a supervisory authority
  2. Consent must always be given in writing and notarised
  3. Consent must be given by the child regardless of age
  4. Consent must be given or authorised by the holder of parental responsibility where the child is below the age set by Member State law, between 13 and 16 Correct answer.

Explanation

Article 8 GDPR makes the processing of a child's data lawful where the child is at least 16, or such lower age not below 13 as Member State law provides, and otherwise requires consent from the holder of parental responsibility. The controller must make reasonable efforts to verify such consent. Consent need not be notarised or given to an authority.

Question 18Data Protection Law and Regulatory Frameworks

What does the accountability principle in Article 5(2) GDPR require of a controller?

  1. Appointing a Data Protection Officer in all cases
  2. Obtaining prior authorisation for each new processing activity
  3. Registering every processing operation with the supervisory authority
  4. Demonstrating compliance with the data protection principles Correct answer.

Explanation

Article 5(2) GDPR makes the controller responsible for and able to demonstrate compliance with the principles in Article 5(1). This underpins tools such as records of processing, DPIAs and privacy by design. Registration, prior authorisation and mandatory DPO appointment are not general requirements under the GDPR.

Question 19Data Protection Law and Regulatory Frameworks

Which of the following is an example of privacy by design under Article 25 GDPR?

  1. Obtaining consent through a pre-ticked box
  2. Configuring a system to pseudonymise personal data by default Correct answer.
  3. Publishing a privacy notice on the company website
  4. Retaining all data indefinitely to avoid deletion errors

Explanation

Article 25 GDPR requires data protection by design and by default, including appropriate technical measures such as pseudonymisation. Implementing such measures at the design stage and by default is the essence of the principle. Pre-ticked boxes do not constitute valid consent, and indefinite retention breaches storage limitation.

Question 20Data Protection Law and Regulatory Frameworks

A processor receives a request from a data subject to exercise their rights. What does the GDPR require the processor to do?

  1. Answer the request directly and independently
  2. Forward the request to the controller without undue delay Correct answer.
  3. Reject the request because processors have no obligations
  4. Notify the competent supervisory authority instead of the controller

Explanation

Article 28(3)(e) GDPR requires the processor to assist the controller by appropriate technical and organisational measures, insofar as possible, in fulfilling the obligation to respond to requests exercising data subject rights. In practice this means passing requests to the controller promptly. The controller remains responsible for answering the request.

Question 21Data Protection Law and Regulatory Frameworks

Which of the following best describes the role of a joint controller under Article 26 GDPR?

  1. Two or more controllers jointly determine the purposes and means of processing Correct answer.
  2. A supervisory authority oversees two controllers processing the same data
  3. A controller and a processor share responsibility equally
  4. A processor determines the means of processing on behalf of the controller

Explanation

Article 26 GDPR applies where two or more controllers jointly determine the purposes and means of processing. They must arrange their respective responsibilities transparently, in particular regarding the exercise of data subject rights. The essence of the arrangement must be made available to data subjects.

Question 22Data Protection Law and Regulatory Frameworks

A controller wants to rely on consent as a lawful basis for processing employee data in an employment relationship. Which concern is most relevant under the GDPR?

  1. Consent is invalid unless witnessed by a supervisory authority
  2. Consent cannot be used for any type of employee data
  3. Consent must be renewed every 12 months by law
  4. Consent may not be freely given because of the imbalance of power between employer and employee Correct answer.

Explanation

Recital 43 and EDPB guidance indicate that consent is presumed not to be freely given where there is a clear imbalance between the data subject and the controller, as in employment. Employers should generally rely on other lawful bases for mandatory processing. There is no statutory renewal period or witness requirement for consent.

Question 23Data Protection Law and Regulatory Frameworks

Which of the following is a valid Article 49 GDPR derogation for a transfer to a third country in the absence of an adequacy decision or appropriate safeguards?

  1. The controller has a legitimate interest in the transfer and no other basis is available
  2. The transfer is necessary for the controller's marketing purposes
  3. The data subject has explicitly consented to the proposed transfer after being informed of the possible risks Correct answer.
  4. The transfer is occasional and the recipient is a public authority

Explanation

Article 49(1)(a) GDPR permits transfers where the data subject has explicitly consented to the proposed transfer after being informed of the possible risks of such transfers. Derogations are interpreted restrictively and are not intended for routine, repetitive transfers. Legitimate interests and marketing purposes are not standalone derogations.

Question 24Data Protection Law and Regulatory Frameworks

What must a controller include in the record of processing activities under Article 30 GDPR?

  1. The names and home addresses of all data subjects
  2. The purposes of processing, categories of data subjects and recipients Correct answer.
  3. The personal bank details of the Data Protection Officer
  4. The full text of every marketing email sent

Explanation

Article 30(1) GDPR lists the required contents of the record, including purposes, categories of data subjects and personal data, recipients, transfers to third countries and retention periods. It does not require identifying individual data subjects or retaining copies of communications. The record supports accountability and supervisory oversight.

Question 25Data Protection Law and Regulatory Frameworks

Which right allows a data subject to obtain from the controller confirmation as to whether personal data concerning them is being processed and to receive a copy?

  1. Right of access Correct answer.
  2. Right to data portability
  3. Right to object
  4. Right to rectification

Explanation

Article 15 GDPR grants the right of access, including confirmation of whether data is processed and a copy of the personal data. The controller must also provide information about purposes, categories, recipients and retention. Rectification concerns correcting inaccurate data, and objection concerns stopping certain processing.

Question 26Data Protection Law and Regulatory Frameworks

Under the GDPR, which principle requires that personal data be kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed?

  1. The accuracy principle
  2. The integrity and confidentiality principle
  3. The storage limitation principle Correct answer.
  4. The data minimisation principle

Explanation

Article 5(1)(e) GDPR establishes the storage limitation principle, which requires that personal data be kept in a form permitting identification of data subjects for no longer than necessary for the processing purposes. This principle is distinct from data minimisation, which concerns the amount of data collected, and from accuracy, which concerns the correctness of data. It operates alongside the other principles in Article 5 and is a core element of the GDPR's accountability framework.

Question 27Data Protection Law and Regulatory Frameworks

A company's data protection officer (DPO) is asked about the DPO's reporting line. According to the GDPR, to whom should the DPO report within the organisation?

  1. The highest level of management Correct answer.
  2. The controller's external legal counsel
  3. The head of the IT department
  4. The head of the legal department

Explanation

Article 38(3) GDPR provides that the DPO shall report directly to the highest level of management. This is intended to ensure the DPO's independence and effectiveness. Reporting to a functional head such as IT or legal would undermine the DPO's ability to operate independently and would not satisfy the GDPR requirement.

Question 28Data Protection Law and Regulatory Frameworks

A controller is preparing a data protection impact assessment (DPIA) for a new processing operation. Which of the following must the DPIA include under Article 35 GDPR?

  1. The names and contact details of all data subjects affected
  2. A description of the envisaged processing operations and the purposes of the processing Correct answer.
  3. A copy of the controller's record of processing activities
  4. A binding opinion from the supervisory authority approving the processing

Explanation

Article 35(7)(a) GDPR requires a DPIA to contain at least a systematic description of the envisaged processing operations and the purposes of the processing. The other elements required include an assessment of necessity and proportionality, an assessment of risks, and the measures envisaged to address those risks. A DPIA does not require a copy of the record of processing activities, the names of data subjects, or prior binding approval from the supervisory authority.

Question 29Data Protection Law and Regulatory Frameworks

A controller transfers personal data to a processor located in a third country without an adequacy decision. The controller wants to rely on standard data protection clauses adopted by the European Commission. What must the controller do before making the transfer?

  1. Replace the standard clauses with the processor's own contractual terms
  2. Publish the standard contractual clauses in the EU Official Journal
  3. Conduct a transfer impact assessment to determine whether the third country's laws prevent the processor from complying with the clauses Correct answer.
  4. Obtain a separate authorisation from the European Data Protection Board for each transfer

Explanation

Following the Schrems II judgment, controllers relying on standard contractual clauses must conduct a transfer impact assessment to evaluate whether the legal framework of the third country undermines the effectiveness of the clauses. If it does, supplementary measures must be adopted or the transfer must not proceed. This assessment is a practical obligation derived from the GDPR and the Court's interpretation, not a formal authorisation process.

Question 30Data Protection Law and Regulatory Frameworks

A supervisory authority is investigating a controller for an infringement of the GDPR. The controller argues that it should not be subject to an administrative fine because the infringement was committed by its processor. Which statement best reflects the GDPR's approach to liability in this situation?

  1. The controller is liable for the processor's infringement where the processor acted on the controller's instructions, but the processor may also be liable for breaches of its own direct obligations Correct answer.
  2. Only the processor can be fined, because the infringement occurred at the processor's premises
  3. The controller is never liable for acts of its processor, because the processor is a separate legal entity
  4. The supervisory authority must fine both the controller and the processor jointly and severally in every case

Explanation

Under Article 28 GDPR, the processor must act only on the controller's instructions, and the controller remains responsible for compliance. Article 83 allows fines to be imposed on both controllers and processors for infringements of their respective obligations. A processor that goes beyond its instructions or breaches its direct Article 28 obligations can be liable independently, while the controller can be liable for the processing it has instructed.

Question 31Data Privacy Principles and Governance

Under the GDPR, which principle requires that personal data be collected for specified, explicit and legitimate purposes and not further processed in a manner incompatible with those purposes?

  1. Integrity and confidentiality
  2. Storage limitation
  3. Data minimisation
  4. Purpose limitation Correct answer.

Explanation

Purpose limitation is the principle that binds a controller to the declared, explicit and legitimate purposes at collection and restricts incompatible secondary use. Storage limitation concerns retention periods, minimisation concerns adequacy and necessity of the data itself, and integrity and confidentiality concerns security. These are four distinct principles, so only purpose limitation addresses the compatibility test for further processing.

Question 32Data Privacy Principles and Governance

A company wants to demonstrate to a supervisory authority that its processing activities comply with the GDPR. Which accountability mechanism most directly provides a structured, written record of processing activities?

  1. A records of processing activities register Correct answer.
  2. A penetration test report
  3. A privacy notice on the website
  4. A data processing agreement with a vendor

Explanation

Article 30 requires controllers and processors to maintain records of processing activities, which serve as the structured written inventory of what is processed, why, by whom and where. A privacy notice informs data subjects, a DPA governs a processor relationship, and a penetration test addresses security testing. Only the records register gives the authority the comprehensive processing inventory.

Question 33Data Privacy Principles and Governance

Which concept describes the situation where a controller determines the purposes and means of processing personal data?

  1. Joint controller
  2. Controller Correct answer.
  3. Recipient
  4. Processor

Explanation

The controller is the entity that alone or jointly determines the purposes and means of the processing. A processor acts on the controller's behalf, joint controllers share the determination of purposes and means, and a recipient merely receives data. The defining test is the decision-making power over why and how data is processed.

Question 34Data Privacy Principles and Governance

A retailer collects a customer's email address to send an order confirmation and later decides to use the same address for a separate newsletter campaign. What does the purpose limitation principle require for the newsletter use?

  1. The retailer may proceed because the email address is already lawfully held
  2. The retailer must delete the address after the order confirmation is sent
  3. The retailer only needs to update its security policy
  4. The retailer must assess whether the newsletter is compatible with the original purpose or obtain a valid legal basis such as consent Correct answer.

Explanation

Further processing must either be compatible with the original purpose or rest on its own lawful basis. A newsletter is a new purpose, so the retailer must run a compatibility assessment or rely on consent where required. Merely holding the data lawfully does not authorise any new use, and deletion or security updates do not address the purpose question.

Question 35Data Privacy Principles and Governance

A controller receives a data subject access request. Which governance practice best supports timely and defensible handling of such requests?

  1. Delegating all requests informally to whichever employee is available
  2. Relying on the IT helpdesk to answer requests without recording them
  3. A documented request-handling procedure with defined roles, identity verification and response timelines Correct answer.
  4. A policy stating that all requests are refused unless made in person

Explanation

Accountability requires demonstrable, repeatable processes, so a documented procedure with clear roles, identity verification and tracked deadlines makes compliance auditable. Informal delegation or unrecorded handling creates gaps and inconsistent outcomes. Blanket refusal policies conflict with data subject rights and cannot be justified generally.

Question 36Data Privacy Principles and Governance

What is the primary role of a data protection impact assessment in a privacy governance programme?

  1. To identify and mitigate high risks to data subjects before processing begins Correct answer.
  2. To serve as the privacy notice published to data subjects
  3. To transfer liability from the controller to the processor
  4. To replace the need for a records of processing register

Explanation

A DPIA is a risk-management tool used before processing likely to result in high risk, identifying risks and the measures that mitigate them. It complements rather than replaces the records register, does not shift liability, and is an internal assessment rather than a public notice. Its function is prospective risk identification and mitigation.

Question 37Data Privacy Principles and Governance

Which governance artefact most directly operationalises the principle of data minimisation across a product team?

  1. A vendor onboarding questionnaire
  2. A data collection checklist that requires justification of each field against a stated purpose Correct answer.
  3. A retention schedule that sets deletion dates for archived records
  4. An incident response plan for security breaches

Explanation

Minimisation is about collecting only adequate, relevant and necessary data, so a field-by-field justification tied to purpose directly embeds that test in design. Retention schedules address storage limitation, incident plans address breach response, and vendor questionnaires address third-party risk. Only the collection checklist tests necessity at the point of collection.

Question 38Data Privacy Principles and Governance

In a privacy governance model, what distinguishes a data protection officer's position from that of a general compliance manager?

  1. The DPO is responsible for signing all data processing agreements
  2. The DPO acts as the controller's external legal counsel
  3. The DPO has an independent advisory and monitoring role with reporting to the highest management level Correct answer.
  4. The DPO personally decides the lawful basis for every processing operation

Explanation

The DPO monitors compliance, advises and cooperates with the supervisory authority, and must be able to act independently with access to top management. The DPO does not decide lawful bases, sign contracts on the controller's behalf, or act as external counsel. Independence and advisory monitoring are the defining features of the role.

Question 39Data Privacy Principles and Governance

A company transfers personal data to a processor in a third country without an adequacy decision. Which governance step is required to legitimise the transfer?

  1. Put in place an appropriate transfer mechanism such as standard contractual clauses and assess the local legal context Correct answer.
  2. Publish the transfer in the privacy notice and proceed
  3. Obtain a one-off consent from the processor's employees
  4. Rely on the processor's own privacy policy

Explanation

Where no adequacy decision exists, the controller must use a transfer tool such as standard contractual clauses or binding corporate rules and assess whether the destination law undermines the safeguards. Publication or a processor's policy does not create a legal transfer mechanism. Consent from the processor's employees is irrelevant to the controller's transfer obligations.

Question 40Data Privacy Principles and Governance

What does the principle of storage limitation require a controller to establish?

  1. Defined retention periods with deletion or anonymisation when the purpose is fulfilled Correct answer.
  2. Retention for the maximum period permitted by local law
  3. Retention until the data subject requests erasure
  4. Indefinite retention for any data that might be useful later

Explanation

Storage limitation requires that identifiable data be kept no longer than necessary for the purposes, which means defined retention periods and deletion or anonymisation at the end. Indefinite retention and reliance solely on erasure requests fail the necessity test. Keeping data for the maximum period allowed is not the same as keeping it only as long as needed.

Question 41Data Privacy Principles and Governance

A marketing team proposes using a hashed customer list for audience matching on an ad platform. Which governance analysis is most appropriate?

  1. Proceed because hashing is a security measure
  2. Assess whether the hashed identifiers remain personal data and whether the new use is compatible with the original purpose Correct answer.
  3. Assume the ad platform is a controller and no agreement is needed
  4. Conclude that hashing always removes the data from scope

Explanation

Hashing is pseudonymisation, which reduces risk but generally leaves data personal where re-identification remains possible, so scope and purpose compatibility must be assessed. Hashing does not automatically take data outside the regulation, and the platform's role and any agreement still need review. Treating hashing as sufficient on its own skips the required analysis.

Question 42Data Privacy Principles and Governance

Which arrangement best reflects the GDPR requirement for joint controllers?

  1. An oral understanding that one party handles all compliance without documentation
  2. A processor agreement appointing one party as the sole decision-maker
  3. A unilateral policy published only by the larger party
  4. A transparent arrangement allocating responsibilities, particularly for data subject rights, with the essence made available Correct answer.

Explanation

Joint controllers must arrange their respective responsibilities transparently, especially for rights requests and transparency duties, and make the essence of the arrangement available to data subjects. An undocumented oral understanding, a mislabelled processor agreement, or a unilateral policy does not satisfy this. The allocation must reflect genuine shared determination of purposes and means.

Question 43Data Privacy Principles and Governance

A controller wants to rely on legitimate interests for a new analytics feature. Which governance step is essential to support that reliance?

  1. A documented legitimate interests assessment balancing the controller's interest against data subjects' rights and expectations Correct answer.
  2. A signed consent form from every website visitor
  3. A notification to the supervisory authority before launch
  4. An adequacy decision covering the analytics vendor

Explanation

Relying on legitimate interests requires a three-part assessment: a legitimate interest, necessity of the processing, and a balancing test against data subjects' rights and expectations, documented for accountability. Consent is an alternative basis, prior authorisation is generally not required, and adequacy concerns transfers rather than the lawful basis.

Question 44Data Privacy Principles and Governance

Which statement best captures the relationship between privacy by design and privacy by default?

  1. By design and by default are synonyms for publishing a privacy notice
  2. By default applies only to security controls, while by design applies only to marketing
  3. By design requires user opt-in for every processing operation
  4. By design embeds protections throughout the processing lifecycle, while by default ensures the most privacy-protective settings apply without user action Correct answer.

Explanation

Privacy by design integrates safeguards into the design of processing and throughout its lifecycle, while privacy by default ensures that, without intervention, only necessary data is processed and protective settings apply. They are complementary but distinct obligations, not synonyms for transparency, and they are not limited to security or marketing. Requiring opt-in for every operation misstates both concepts.

Question 45Data Privacy Principles and Governance

An organisation is selecting a new cloud vendor that will process personal data. Which governance control most directly addresses the controller's obligations toward the processor?

  1. The vendor's standard terms of service accepted without review
  2. A non-disclosure agreement covering commercial secrets only
  3. A service level agreement focused on uptime
  4. A written data processing agreement specifying instructions, security, sub-processor rules and assistance duties Correct answer.

Explanation

The controller must govern the processor relationship through a contract that sets out the subject matter, duration, nature and purpose of processing, plus the processor's obligations on security, sub-processors, assistance and deletion. An NDA on commercial secrets, un-reviewed standard terms, or an uptime SLA does not address these data protection duties. Only the DPA maps to the required processor obligations.

Question 46Data Privacy Principles and Governance

What is the function of a data protection impact assessment screening or threshold analysis?

  1. To certify the organisation's compliance to the supervisory authority
  2. To calculate the financial cost of a potential fine
  3. To determine whether processing is likely to result in high risk and therefore requires a full DPIA Correct answer.
  4. To decide which lawful basis the controller must use

Explanation

Screening applies criteria such as systematic monitoring, large-scale special category data or innovative technology to decide whether a full DPIA is needed. It is not a fine calculator, does not select the lawful basis, and does not certify compliance. Its purpose is to triage processing operations against high-risk indicators.

Question 47Data Privacy Principles and Governance

A controller discovers that a processor has engaged a sub-processor without authorisation. What is the most appropriate governance response?

  1. Immediately report a personal data breach to the supervisory authority in every case
  2. Take no action because the processor remains liable for all acts
  3. Terminate all processing and delete all data without further analysis
  4. Assess the breach of the processing agreement and require authorisation or removal of the sub-processor Correct answer.

Explanation

Unauthorised sub-processing is a contractual and compliance failure that must be assessed and remedied, typically by requiring prior authorisation or having the sub-processor removed. Liability allocation does not make the issue acceptable, and not every unauthorised sub-processor automatically constitutes a reportable personal data breach. Immediate wholesale termination is a disproportionate response taken without analysis.

Question 48Data Privacy Principles and Governance

Which practice best supports the accuracy principle in a customer relationship management system?

  1. Providing a mechanism for customers to review and correct their details, with periodic data quality checks Correct answer.
  2. Retaining historical records indefinitely for completeness
  3. Relying on customers to notice errors without any correction channel
  4. Storing multiple conflicting versions of the same record

Explanation

Accuracy requires that personal data be accurate and, where necessary, kept up to date, with every reasonable step taken to erase or rectify inaccurate data. A correction channel plus periodic quality checks operationalises this. Indefinite retention of stale data, the absence of a correction route, and conflicting duplicate records all undermine accuracy.

Question 49Data Privacy Principles and Governance

A supervisory authority requests evidence of how an organisation applies the principle of accountability. Which set of artefacts best demonstrates this?

  1. The organisation's marketing brochure
  2. A list of employees who have access to the building
  3. A single signed statement by the chief executive
  4. Policies, training records, DPIA outcomes and audit findings showing controls in operation Correct answer.

Explanation

Accountability requires the controller to be able to demonstrate compliance, which is shown through documented policies, training, assessments and audit evidence that controls actually operate. A single executive statement, marketing material, or a building access list does not evidence data protection controls. Demonstrability depends on operational records, not assertions.

Question 50Data Privacy Principles and Governance

A business unit wants to introduce biometric access control for all staff. Which governance consideration is most significant under data protection principles?

  1. Biometric data for unique identification is special category data requiring a specific lawful basis and a DPIA Correct answer.
  2. Biometric data is exempt because it is used for security
  3. Only the vendor's consent is required
  4. The data can be processed freely if employees are informed

Explanation

Biometric data processed to uniquely identify a person is special category data, requiring a lawful basis under the general rules plus a specific condition, and processing is likely to be high risk so a DPIA is expected. Security use does not create an exemption, vendor consent is irrelevant, and informing employees does not substitute for a valid legal basis and condition.