I85PREP
⌘ K
CPPA study materials
CPPA study resources

CPPA practice questions

One question at a time. Build your CPPA understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Privacy and Data Protection Foundations

Under the CPPA, which term describes information that can be linked to a specific identified or identifiable individual?

  1. Public record
  2. Personal information Correct answer.
  3. Anonymized data
  4. Aggregated statistics

Explanation

Personal information is the foundational CPPA concept covering data tied to an identified or identifiable individual. Aggregated and anonymized data are treated differently precisely because they cannot be linked back to a person.

Question 2Privacy and Data Protection Foundations

Which concept captures an individual's right to decide how their personal information is collected and used?

  1. Privacy Correct answer.
  2. Security audit
  3. Retention schedule
  4. Data minimization

Explanation

Privacy centers on individual control over how personal information is gathered, used, and shared. The other options are operational practices rather than the underlying right itself.

Question 3Privacy and Data Protection Foundations

A company collects a customer's name and email to fulfill an order. Which data role does the customer occupy?

  1. Data processor
  2. Data controller
  3. Data subject Correct answer.
  4. Supervisory authority

Explanation

The data subject is the individual whom the personal information describes. The company deciding why and how to process the data is the controller, and any vendor acting on its behalf is a processor.

Question 4Privacy and Data Protection Foundations

Which principle limits collection of personal information to what is necessary for a stated purpose?

  1. Transparency
  2. Purpose limitation
  3. Accountability
  4. Data minimization Correct answer.

Explanation

Data minimization requires that only the personal information needed for the stated purpose be collected. Purpose limitation is related but addresses restricting use to the declared purpose rather than the volume collected.

Question 5Privacy and Data Protection Foundations

A retailer wants to use customer purchase history for a new marketing program. Which principle most directly requires informing customers about this new use?

  1. Access
  2. Security
  3. Notice Correct answer.
  4. Data quality

Explanation

Notice requires that individuals be informed about how their personal information will be used, including new purposes. Without adequate notice, the new marketing use lacks a proper basis.

Question 6Privacy and Data Protection Foundations

Which statement best describes the difference between privacy and data security?

  1. Privacy governs use of information while security protects it Correct answer.
  2. They are identical concepts used interchangeably
  3. Privacy applies only to government agencies
  4. Security applies only to paper records

Explanation

Privacy addresses whether and how information should be used, while security addresses protecting it from unauthorized access or loss. The two are complementary but distinct obligations.

Question 7Privacy and Data Protection Foundations

Which of the following is generally considered sensitive personal information requiring heightened protection?

  1. Product preference
  2. Office mailing address
  3. Job title
  4. Health diagnosis Correct answer.

Explanation

Health information is widely treated as sensitive because misuse can cause significant harm, so it typically attracts stricter handling requirements. Ordinary business contact details and preferences are handled under standard rules.

Question 8Privacy and Data Protection Foundations

An organization stores personal information longer than needed for its stated purpose. Which principle is most directly violated?

  1. Accuracy
  2. Retention limitation Correct answer.
  3. Safeguards
  4. Participation

Explanation

Retention limitation requires that personal information be kept only as long as necessary for the purpose. Keeping it beyond that period conflicts with this principle regardless of how well it is protected.

Question 9Privacy and Data Protection Foundations

A company transfers customer data to a vendor that processes it only on the company's instructions. What role does the vendor play?

  1. Controller
  2. Processor Correct answer.
  3. Regulator
  4. Data subject

Explanation

A processor handles personal information on behalf of and under the instructions of a controller. The company determining the purpose remains the controller.

Question 10Privacy and Data Protection Foundations

An individual asks a company to correct an error in their stored address. Which privacy principle supports this request?

  1. Notice
  2. Consent
  3. Minimization
  4. Data quality Correct answer.

Explanation

Data quality requires that personal information be accurate, complete, and current, which supports correction requests. Consent, notice, and minimization address different obligations and do not directly govern accuracy.

Question 11Privacy and Data Protection Foundations

Which pairing correctly matches a privacy principle with its core requirement?

  1. Accountability - designating responsibility for compliance Correct answer.
  2. Access - limiting collection to necessary data
  3. Consent - ensuring data is accurate
  4. Security - informing individuals of purposes

Explanation

Accountability requires an organization to designate responsibility and be able to demonstrate compliance. The other pairings mismatch each principle with an unrelated requirement.

Question 12Privacy and Data Protection Foundations

A hospital shares patient records with a research partner without consent or legal authority. Which privacy concern is most directly raised?

  1. Secondary use without authorization Correct answer.
  2. Excessive retention
  3. Poor data quality
  4. Insufficient encryption

Explanation

Sharing data for a purpose beyond the original one without consent or legal authority is a secondary-use problem. Encryption, retention, and accuracy are separate concerns not described here.

Question 13Privacy and Data Protection Foundations

Which scenario best illustrates the principle of transparency?

  1. A firm trains staff on password hygiene
  2. A firm deletes records after one year
  3. A firm publishes a clear notice describing what data it collects and why Correct answer.
  4. A firm encrypts all customer records

Explanation

Transparency means openly communicating data practices so individuals understand what happens to their information. Encryption, deletion, and training are safeguards or retention practices rather than transparency.

Question 14Privacy and Data Protection Foundations

Which term refers to data that has been stripped of identifiers so individuals can no longer be identified?

  1. Encrypted data
  2. Aggregated data
  3. Pseudonymized data
  4. Anonymized data Correct answer.

Explanation

Anonymized data has identifiers removed so re-identification is no longer reasonably possible. Pseudonymized data still permits re-identification when combined with additional information.

Question 15Privacy and Data Protection Foundations

A company relies on consent to process personal information. Which condition makes that consent most defensible?

  1. It is assumed from continued website use
  2. It is freely given, specific, and informed Correct answer.
  3. It is obtained after processing begins
  4. It is bundled into unrelated terms of service

Explanation

Valid consent must be freely given, specific, informed, and unambiguous about the processing it covers. Bundling, implied use, or retroactive consent undermine those qualities.

Question 16Privacy and Data Protection Foundations

Which obligation most closely reflects the accountability principle?

  1. Informing individuals of purposes
  2. Demonstrating compliance through policies and records Correct answer.
  3. Collecting only the minimum data
  4. Correcting inaccurate records

Explanation

Accountability requires organizations to be able to demonstrate compliance, often through documented policies, records, and controls. The other options describe separate principles such as minimization, notice, and accuracy.

Question 17Privacy and Data Protection Foundations

A marketing team wants to repurpose email addresses collected for order confirmations. Which analysis is most accurate?

  1. Repurposing is prohibited unless the data is anonymized
  2. Repurposing is permitted only if the data is encrypted
  3. Repurposing requires assessing compatibility with the original purpose and any needed notice or consent Correct answer.
  4. Repurposing is always permitted because the data is already held

Explanation

Purpose limitation requires evaluating whether a new use is compatible with the original purpose and, if not, obtaining a lawful basis such as consent or providing new notice. Neither anonymization nor encryption resolves the purpose question.

Question 18Privacy and Data Protection Foundations

Which statement correctly distinguishes a data controller from a data processor?

  1. The processor bears primary responsibility for lawful basis
  2. The controller only stores data on behalf of others
  3. The processor decides why data is collected
  4. The controller determines purposes and means of processing Correct answer.

Explanation

The controller decides why and how personal information is processed, while the processor acts on the controller's instructions. Responsibility for lawful basis generally rests with the controller.

Question 19Privacy and Data Protection Foundations

Which practice best exemplifies privacy by design?

  1. Storing all data indefinitely for future flexibility
  2. Adding privacy controls after a product launch
  3. Relying on users to read lengthy policies
  4. Building data minimization into a system from the outset Correct answer.

Explanation

Privacy by design embeds protections such as minimization into systems from the beginning rather than retrofitting them. Post-launch fixes, reliance on user diligence, and indefinite storage reflect weaker approaches.

Question 20Privacy and Data Protection Foundations

An organization wants to use personal information for a purpose that is incompatible with the original one. What is the most appropriate privacy response?

  1. Proceed because the data is already collected
  2. Encrypt the data and proceed
  3. Identify a lawful basis for the new purpose and provide required notice Correct answer.
  4. Delete the data after the new use

Explanation

Incompatible new uses require a lawful basis, such as fresh consent, and appropriate notice to individuals. Prior collection, encryption, or later deletion does not authorize the incompatible use.

Question 21Privacy and Data Protection Foundations

A firm argues its dataset is anonymous because it removed names, yet it retains birth dates and postal codes. Which assessment is most sound?

  1. The data is fully anonymous because names are removed
  2. The data may remain identifiable through combination and should be treated as personal information Correct answer.
  3. The data is anonymous because postal codes are public
  4. The data is sensitive only if names are present

Explanation

Removing names alone does not guarantee anonymity when other fields can be combined to single out individuals. Such data should generally still be treated as personal information.

Question 22Privacy and Data Protection Foundations

Which scenario most clearly creates a conflict between the access principle and the security principle?

  1. An individual requests their record while the organization must verify identity before release Correct answer.
  2. A firm schedules periodic deletion of old records
  3. A firm trains staff on phishing awareness
  4. A firm encrypts records at rest

Explanation

Access rights require giving individuals their information, while security requires confirming the requester's identity to prevent improper disclosure. Balancing these duties is the conflict, whereas the other options involve only safeguards or retention.

Question 23Privacy and Data Protection Foundations

A company collects data under a valid purpose, then a vendor uses it for an unrelated analytics product. Which principle is most directly implicated?

  1. Data quality
  2. Participation
  3. Purpose limitation Correct answer.
  4. Access

Explanation

Purpose limitation restricts processing to the purposes for which data was collected unless a new lawful basis exists. An unrelated vendor use exceeds the original purpose and directly implicates this principle.

Question 24Privacy and Data Protection Foundations

Which reasoning best explains why sensitive data categories receive stricter treatment than ordinary personal information?

  1. They cannot be processed under any circumstances
  2. Their misuse can cause greater harm, justifying heightened safeguards Correct answer.
  3. They are exempt from retention limits
  4. They are always stored electronically

Explanation

Sensitive categories such as health or financial data attract stricter rules because misuse can cause serious harm, warranting additional safeguards and tighter conditions. They are not absolutely prohibited, and storage medium is irrelevant.

Question 25Privacy and Data Protection Foundations

An organization claims compliance because it has a privacy policy, yet it cannot show how the policy is enforced. Which principle is most clearly unmet?

  1. Accuracy
  2. Minimization
  3. Notice
  4. Accountability Correct answer.

Explanation

Accountability requires demonstrating that practices actually comply, not merely publishing a policy. Without evidence of enforcement, the organization cannot show accountability even if a notice exists.

Question 26Privacy and Data Protection Foundations

Which concept describes an individual's right to control how their personal information is collected, used, and shared?

  1. Data security
  2. Consent
  3. Privacy Correct answer.
  4. Data minimization

Explanation

Privacy is the broader concept that encompasses an individual's ability to control their personal information and decide how it is used. Data security and data minimization are practices that support privacy, while consent is one mechanism for obtaining permission.

Question 27Privacy and Data Protection Foundations

A retailer collects a customer's email address at checkout and later uses it to send unrelated promotional offers without asking for permission. Which privacy principle is most directly implicated?

  1. Storage limitation
  2. Accuracy
  3. Purpose limitation Correct answer.
  4. Accountability

Explanation

Purpose limitation requires that personal information be used only for the purposes for which it was collected or for compatible purposes. Using an email provided for order confirmation to send unrelated marketing violates that principle unless a new basis is established.

Question 28Privacy and Data Protection Foundations

Which practice best demonstrates the principle of data minimization?

  1. Requiring users to consent to all possible future uses
  2. Collecting only the fields needed to fulfill the stated purpose Correct answer.
  3. Sharing data with partners to improve service quality
  4. Retaining all collected data for a fixed period regardless of need

Explanation

Data minimization means limiting collection and use of personal information to what is directly relevant and necessary for the specified purpose. Collecting only needed fields is the clearest example, while the other options involve broader collection or use.

Question 29Privacy and Data Protection Foundations

An organization wants to rely on consent as its legal basis for processing personal information. Which condition is essential for that consent to be valid?

  1. It must be renewed every month
  2. It must be obtained in writing and notarized
  3. It must be bundled with the terms of service
  4. It must be freely given, specific, informed, and unambiguous Correct answer.

Explanation

Valid consent generally requires that it be freely given, specific, informed, and an unambiguous indication of the individual's wishes. Written notarization, bundling, or fixed renewal periods are not inherent requirements and may undermine validity.

Question 30Privacy and Data Protection Foundations

A company removes names and account numbers from a dataset but retains full dates of birth and detailed location history. It claims the data is anonymous and outside privacy obligations. Which analysis is most accurate?

  1. The data remains personal information because it can still be linked to individuals through indirect identifiers. Correct answer.
  2. The data is anonymous only if stored in a secure database.
  3. The data is anonymous because direct identifiers were removed.
  4. The data is pseudonymous and therefore always exempt from privacy laws.

Explanation

Anonymization requires that individuals can no longer be identified by any means reasonably likely to be used. Retaining quasi-identifiers such as full birth dates and detailed location history means re-identification remains possible, so the data is still personal information.

Question 31Global Privacy Laws and Regulatory Frameworks

Under the GDPR, which legal basis requires the data subject's consent to be freely given, specific, informed, and unambiguous, expressed by a statement or clear affirmative action?

  1. Legitimate interests under Article 6(1)(f)
  2. Legal obligation under Article 6(1)(c)
  3. Consent under Article 6(1)(a) Correct answer.
  4. Performance of a contract under Article 6(1)(b)

Explanation

Article 6(1)(a) makes consent a lawful basis only where it meets the Article 4(11) quality test: freely given, specific, informed, unambiguous, and signalled by a statement or clear affirmative action. The other Article 6 bases do not depend on the data subject's permission at all.

Question 32Global Privacy Laws and Regulatory Frameworks

A company based in Germany processes personal data of German customers entirely within Germany. Which instrument is the primary source of its data protection obligations?

  1. The Council of Europe Convention 108+ alone
  2. The OECD Privacy Guidelines
  3. The APEC Cross-Border Privacy Rules
  4. The GDPR as supplemented by German national law Correct answer.

Explanation

The GDPR is directly applicable in all EU Member States, and Germany may supplement it in permitted areas such as employment context and supervisory authority structure. Convention 108+, the OECD Guidelines, and APEC CBPR are international instruments that do not directly govern this purely domestic processing.

Question 33Global Privacy Laws and Regulatory Frameworks

Which principle of the GDPR limits processing to what is adequate, relevant, and necessary in relation to the stated purposes?

  1. Integrity and confidentiality
  2. Storage limitation
  3. Accountability
  4. Data minimisation Correct answer.

Explanation

Article 5(1)(c) codifies data minimisation: personal data must be adequate, relevant, and limited to what is necessary for the purposes. Storage limitation instead caps retention periods, and integrity and confidentiality concerns security of processing.

Question 34Global Privacy Laws and Regulatory Frameworks

A US-based online retailer with no EU establishment offers goods to customers in France and monitors their browsing behaviour. Under the GDPR, what is the consequence?

  1. The GDPR does not apply because the retailer lacks an EU establishment
  2. The GDPR applies only if the retailer appoints an EU representative voluntarily
  3. The GDPR applies through the extraterritorial reach of Article 3(2) Correct answer.
  4. The GDPR applies only to data collected from customers who are EU citizens

Explanation

Article 3(2) extends the GDPR to controllers without an EU establishment where they offer goods or services to data subjects in the Union or monitor their behaviour. Offering to French customers and monitoring browsing both trigger the territorial scope.

Question 35Global Privacy Laws and Regulatory Frameworks

Which body issues binding decisions on disputes between EU national supervisory authorities under the GDPR's consistency mechanism?

  1. The European Data Protection Board Correct answer.
  2. The European Ombudsman
  3. The European Commission
  4. The Court of Justice of the European Union

Explanation

The European Data Protection Board, composed of the heads of national supervisory authorities and the EDPS, adopts binding decisions under Article 65 to resolve disagreements in cross-border cases. The Commission and the Ombudsman have no such adjudicative role, and the CJEU hears legal appeals rather than supervisory disputes.

Question 36Global Privacy Laws and Regulatory Frameworks

When is a data protection impact assessment mandatory under Article 35 of the GDPR?

  1. Only when the supervisory authority issues a prior authorisation request
  2. Whenever any special category data is processed, regardless of risk
  3. Where processing is likely to result in a high risk to the rights and freedoms of natural persons Correct answer.
  4. Whenever more than 250 employees are involved in processing

Explanation

Article 35(1) requires a DPIA where a type of processing, in particular using new technologies and considering nature, scope, context, and purposes, is likely to result in a high risk. Article 35(3) lists examples such as systematic and extensive evaluation or large-scale special category processing, but the general trigger is high risk.

Question 37Global Privacy Laws and Regulatory Frameworks

A controller receives a data subject access request. Under Article 12(3) of the GDPR, within what period must it generally provide the information?

  1. Within 72 hours of receipt
  2. Within 30 days of receipt
  3. Without undue delay and in any event within one month of receipt Correct answer.
  4. Within three months of receipt

Explanation

Article 12(3) sets a default of one month from receipt, extendable by two further months where requests are complex or numerous, with notification of the extension. The 72-hour figure belongs to breach notification, not access requests.

Question 38Global Privacy Laws and Regulatory Frameworks

Under the GDPR, when must a controller notify a personal data breach to the supervisory authority?

  1. Within 24 hours in every case, regardless of risk
  2. Within 72 hours of becoming aware, unless the breach is unlikely to result in a risk Correct answer.
  3. Only when the breach involves more than 500 data subjects
  4. Only after affected data subjects have been individually informed

Explanation

Article 33(1) requires notification without undue delay and, where feasible, within 72 hours of becoming aware, unless the breach is unlikely to result in a risk to rights and freedoms. Communication to data subjects under Article 34 follows a separate high-risk threshold.

Question 39Global Privacy Laws and Regulatory Frameworks

Which role does a processor play under the GDPR when it engages a subcontractor to help process a controller's data?

  1. It becomes a joint controller with the sub-processor automatically
  2. It must obtain approval from the supervisory authority before any sub-processing
  3. It may freely choose sub-processors because it is not bound by the controller's instructions
  4. It may engage a sub-processor only with the controller's prior specific or general written authorisation Correct answer.

Explanation

Article 28(2) requires the processor to obtain the controller's prior specific or general written authorisation before engaging a sub-processor, and to impose equivalent data protection obligations by contract. The processor remains bound by the controller's documented instructions throughout.

Question 40Global Privacy Laws and Regulatory Frameworks

In which situation does the GDPR's one-stop-shop mechanism allow a lead supervisory authority to act?

  1. Where the controller is established outside the EU but has EU customers
  2. Where a controller has its main establishment in that Member State and processing is cross-border Correct answer.
  3. Where the processing is confined to a single Member State
  4. Where the controller designates any supervisory authority it prefers

Explanation

Article 56 gives the lead supervisory authority competence where a controller or processor has its main establishment in that Member State and the processing is cross-border. Purely domestic processing stays with the local authority, and controllers cannot freely pick their regulator.

Question 41Global Privacy Laws and Regulatory Frameworks

Which statement best captures the accountability principle introduced by the GDPR?

  1. The controller must appoint a data protection officer in all cases
  2. The controller must be able to demonstrate compliance with the data protection principles Correct answer.
  3. The controller must register every processing operation with the supervisory authority
  4. The controller must obtain consent for all processing activities

Explanation

Article 5(2) makes the controller responsible for, and able to demonstrate, compliance with the principles. This underpins tools such as records of processing, DPIAs, and privacy by design, but it does not require universal registration, DPO appointment, or consent.

Question 42Global Privacy Laws and Regulatory Frameworks

Which transfer mechanism under the GDPR requires an assessment of the third country's legal framework and, where necessary, supplementary measures?

  1. A transfer necessary for the performance of a contract with the data subject
  2. An adequacy decision adopted by the European Commission
  3. A transfer to an international organisation under a multilateral treaty
  4. Standard contractual clauses adopted by the European Commission Correct answer.

Explanation

Following Schrems II, exporters relying on Article 46 tools such as standard contractual clauses must verify that the destination country's law provides essentially equivalent protection and add supplementary measures if not. Adequacy decisions under Article 45 already reflect the Commission's own assessment.

Question 43Global Privacy Laws and Regulatory Frameworks

Which of the following is a special category of personal data under Article 9 of the GDPR?

  1. A person's professional email address
  2. A company's VAT registration number
  3. A person's residential postal address
  4. Data revealing racial or ethnic origin Correct answer.

Explanation

Article 9(1) lists data revealing racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic and biometric data, health data, and data concerning sex life or sexual orientation. Ordinary contact and business identifiers do not fall within that list.

Question 44Global Privacy Laws and Regulatory Frameworks

A controller wants to rely on legitimate interests for a new marketing analytics programme. Which step is required by Article 6(1)(f)?

  1. Restrict the processing to employees of the controller
  2. Obtain explicit consent from each data subject before any processing
  3. Carry out a balancing test weighing the controller's interests against the data subject's rights and expectations Correct answer.
  4. Notify the supervisory authority and wait for approval

Explanation

Legitimate interests requires a three-part assessment: a legitimate interest, necessity of the processing, and a balancing of that interest against the data subject's rights and reasonable expectations. Consent and prior authorisation belong to different bases.

Question 45Global Privacy Laws and Regulatory Frameworks

Which right under the GDPR allows a data subject to receive their personal data in a structured, commonly used, machine-readable format and transmit it to another controller?

  1. The right to restriction of processing
  2. The right to rectification
  3. The right to erasure
  4. The right to data portability Correct answer.

Explanation

Article 20 grants data portability, allowing data subjects to receive and reuse data provided to a controller and to transmit it to another controller where processing is based on consent or contract and carried out by automated means. Rectification, erasure, and restriction are distinct rights under Articles 16 to 18.

Question 46Global Privacy Laws and Regulatory Frameworks

What is the maximum administrative fine the GDPR permits for the most serious infringements, such as violations of the basic principles?

  1. 10 million euros or 2% of total worldwide annual turnover, whichever is higher
  2. 20 million euros or 4% of total worldwide annual turnover, whichever is higher Correct answer.
  3. 50 million euros flat, regardless of turnover
  4. 1% of global annual turnover with no fixed cap

Explanation

Article 83(5) sets the upper tier at 20 million euros or 4% of total worldwide annual turnover of the preceding financial year, whichever is higher. The lower tier in Article 83(4) is 10 million euros or 2%.

Question 47Global Privacy Laws and Regulatory Frameworks

A controller based in Ireland processes data of customers across several EU Member States from its Dublin headquarters. Which supervisory authority is the lead authority under the one-stop-shop?

  1. The authority of each customer's Member State, each acting independently
  2. The authority of the Member State with the largest number of affected customers
  3. The European Data Protection Board acting as first-instance regulator
  4. The Irish supervisory authority, because the main establishment is in Ireland Correct answer.

Explanation

The lead supervisory authority is that of the Member State where the controller has its main establishment, which is where the central decision-making takes place. Other authorities act as concerned authorities and cooperate through the consistency mechanism.

Question 48Global Privacy Laws and Regulatory Frameworks

Which of the following best describes the role of a data protection officer under the GDPR?

  1. To approve or veto the controller's lawful bases for processing
  2. To act as the controller's marketing decision-maker for data-driven campaigns
  3. To monitor compliance and advise the controller independently, without receiving instructions on the exercise of the role Correct answer.
  4. To represent the controller in all litigation involving data subjects

Explanation

Article 38 requires the DPO to be involved properly, have resources, and act independently, reporting to the highest management level and not receiving instructions on the exercise of the role. The DPO advises and monitors but does not make business decisions or grant legal approvals.

Question 49Global Privacy Laws and Regulatory Frameworks

Under the GDPR, which requirement applies to consent obtained for processing children's data in relation to information society services?

  1. Children cannot consent to information society services under any circumstances
  2. Parental consent is required only for children under 10 in all Member States
  3. Where consent applies and the child is under 16, consent must be given or authorised by the holder of parental responsibility, unless Member State law sets a lower age not below 13 Correct answer.
  4. Consent from a child of any age is valid without parental involvement

Explanation

Article 8 sets the default age at 16 for consent to information society services, allowing Member States to lower it to no less than 13. Where the child is below the applicable age, the controller must make reasonable efforts to verify parental authorisation.

Question 50Global Privacy Laws and Regulatory Frameworks

Which principle under the GDPR requires that personal data be collected for specified, explicit, and legitimate purposes and not further processed in a manner incompatible with those purposes?

  1. Lawfulness, fairness, and transparency
  2. Purpose limitation Correct answer.
  3. Accuracy
  4. Storage limitation

Explanation

Article 5(1)(b) establishes purpose limitation, which restricts processing to the stated purposes and forbids incompatible further processing. Accuracy concerns the correctness of data, while storage limitation governs retention periods.