I85PREP
⌘ K
CDEF study materials
CDEF study resources

CDEF practice questions

One question at a time. Build your CDEF understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Foundations of Data Ethics and Ethical Theory

Which ethical theory evaluates the rightness of an action solely by its consequences, such as maximizing overall welfare?

  1. Consequentialism Correct answer.
  2. Deontology
  3. Virtue ethics
  4. Contractarianism

Explanation

Consequentialism holds that the moral status of an action depends entirely on its outcomes, so an act is right if it produces the best overall results. Deontology instead grounds duty in rules, virtue ethics centers character, and contractarianism derives norms from agreement among rational parties.

Question 2Foundations of Data Ethics and Ethical Theory

In data ethics, what does 'informed consent' most precisely require of a data subject?

  1. A signature collected at the end of a long terms-of-service document
  2. Approval obtained from a regulator rather than the individual
  3. Agreement given after understanding the purpose, risks, and scope of data use Correct answer.
  4. Implicit acceptance inferred from continued use of a service

Explanation

Informed consent requires that the person understands what data will be collected, why, and with what risks before agreeing. Consent without comprehension or with vague scope fails the 'informed' element, so mere signatures or inferred acceptance are insufficient.

Question 3Foundations of Data Ethics and Ethical Theory

A company trains a hiring model on historical resumes and finds it favors male applicants. Which concept best describes this outcome?

  1. Differential privacy
  2. Purpose limitation
  3. Data minimization
  4. Algorithmic bias Correct answer.

Explanation

Algorithmic bias occurs when a model systematically disadvantages a group, often because it learns patterns from biased historical data. Data minimization and purpose limitation are processing principles, and differential privacy is a disclosure-protection technique, so none describes the discriminatory outcome itself.

Question 4Foundations of Data Ethics and Ethical Theory

Which principle from the Belmont Report concerns fair distribution of the burdens and benefits of research?

  1. Beneficence
  2. Justice Correct answer.
  3. Integrity
  4. Respect for persons

Explanation

Justice in the Belmont framework addresses who bears research burdens and who receives benefits, requiring fair selection of participants. Beneficence concerns maximizing benefit and minimizing harm, while respect for persons concerns autonomy and informed consent.

Question 5Foundations of Data Ethics and Ethical Theory

What is the primary purpose of a data protection impact assessment before deploying a high-risk analytics system?

  1. To replace the need for any ongoing monitoring after launch
  2. To calculate the expected financial return of the analytics project
  3. To identify and mitigate risks to individuals' rights before processing begins Correct answer.
  4. To satisfy marketing requirements for public transparency

Explanation

A data protection impact assessment is a structured, prospective evaluation of how a processing activity may affect individuals and what safeguards are needed. It is a risk-mitigation and accountability instrument, not a financial or marketing exercise, and it does not remove the need for continued monitoring.

Question 6Foundations of Data Ethics and Ethical Theory

Which statement best captures the difference between descriptive and normative ethics?

  1. Descriptive ethics reports how people actually reason; normative ethics prescribes how they ought to reason Correct answer.
  2. Descriptive ethics prescribes ideal behavior; normative ethics merely records observed behavior
  3. Descriptive ethics applies only to computers; normative ethics applies only to humans
  4. Descriptive ethics and normative ethics are synonyms used interchangeably in data ethics

Explanation

Descriptive ethics is an empirical enterprise documenting actual moral beliefs and practices, whereas normative ethics constructs and defends standards for how agents ought to act. Confusing the two leads to the naturalistic fallacy of inferring ought from is.

Question 7Foundations of Data Ethics and Ethical Theory

A researcher removes names and addresses from a dataset before sharing it. Which limitation of this approach is most important to recognize?

  1. Removing direct identifiers does not prevent re-identification through linkage with other data Correct answer.
  2. Removing identifiers automatically satisfies every legal privacy requirement worldwide
  3. Removing identifiers increases the storage cost of the dataset
  4. Removing identifiers makes the dataset impossible to analyze statistically

Explanation

De-identification by removing direct identifiers still leaves quasi-identifiers such as age, postcode, and dates that can be combined with external datasets to re-identify people. Therefore anonymization claims require assessment of linkage risk, not just deletion of names.

Question 8Foundations of Data Ethics and Ethical Theory

Which concept describes a person's reasonable expectation about how their personal information will be collected and used?

  1. Privacy Correct answer.
  2. Ownership
  3. Transparency
  4. Confidentiality

Explanation

Privacy refers to individuals' expectations and control regarding access to their personal information and themselves. Confidentiality is a duty to restrict access to information shared in trust, ownership concerns legal title, and transparency concerns disclosure of practices.

Question 9Foundations of Data Ethics and Ethical Theory

A hospital wants to share patient records with a research consortium. Applying the principle of purpose limitation, what should govern the sharing?

  1. Sharing is always permitted because research is inherently beneficial
  2. The data may be used for any purpose after a fixed retention period elapses
  3. Any new use is acceptable provided the data remain encrypted in transit
  4. Use should stay within the purposes for which the data were originally collected or be re-based on a compatible, disclosed purpose Correct answer.

Explanation

Purpose limitation requires that personal data be used only for specified, explicit purposes established at collection, unless a new use is compatible or separately authorized. Encryption protects security but does not authorize a new purpose, and research benefit alone does not override the limitation.

Question 10Foundations of Data Ethics and Ethical Theory

A team argues that because a dataset is publicly available online, using it to train a facial recognition model raises no ethical issue. Which response best reflects data ethics reasoning?

  1. Only commercial use of public data raises ethical concerns
  2. Public availability always constitutes full legal and ethical authorization for any use
  3. Ethical concerns vanish once the data are stored on a secure server
  4. Public availability does not establish informed consent or legitimate expectations for this new use Correct answer.

Explanation

Availability is not consent: people may post data for one audience without anticipating secondary uses such as biometric model training. Ethical analysis must consider reasonable expectations, potential harms, and whether a legitimate basis exists beyond mere accessibility.

Question 11Foundations of Data Ethics and Ethical Theory

Which scenario best illustrates the ethical tension known as the 'trolley problem' style trade-off in autonomous systems?

  1. A vehicle reduces fuel consumption by optimizing acceleration
  2. A vehicle updates its map data overnight to reflect new road layouts
  3. A vehicle's sensor fails and the manufacturer issues a recall
  4. A vehicle must choose between two harmful outcomes with no option avoiding harm entirely Correct answer.

Explanation

The trolley-problem structure arises when an agent must choose among outcomes that all involve harm, forcing a comparison of harms rather than a harm-free option. Map updates, recalls, and efficiency tuning involve safety or performance but not a forced choice between harms to different parties.

Question 12Foundations of Data Ethics and Ethical Theory

What does the ethical principle of 'data minimization' primarily require?

  1. Sharing data as widely as possible to increase transparency
  2. Encrypting data only after a breach occurs
  3. Collecting only the data necessary for a specified purpose Correct answer.
  4. Retaining all data indefinitely in case it becomes useful

Explanation

Data minimization limits collection and retention to what is adequate, relevant, and necessary for the stated purpose. Hoarding data or broad sharing increases risk without justification, and encryption timing concerns security rather than minimization.

Question 13Foundations of Data Ethics and Ethical Theory

A model used to allocate social benefits produces accurate aggregate predictions but systematically errs for a minority group. Which fairness concern is most directly raised?

  1. Excessive computational cost of the model
  2. Insufficient documentation of the model's source code
  3. Disparate performance across groups despite acceptable overall accuracy Correct answer.
  4. Overly frequent retraining of the model

Explanation

Aggregate accuracy can mask subgroup disparities, so a model may perform well overall while imposing higher error rates on a protected group. This is a distributive fairness concern about error burdens, distinct from cost, documentation, or retraining cadence.

Question 14Foundations of Data Ethics and Ethical Theory

Which action best reflects the ethical duty of accountability when an organization deploys an automated decision system?

  1. Delegating all responsibility to the third-party vendor
  2. Publishing the model's full training data to the public
  3. Removing human review to speed up decision-making
  4. Assigning clear responsibility for oversight and providing a route to contest adverse decisions Correct answer.

Explanation

Accountability requires identifiable owners, effective oversight, and mechanisms for affected people to challenge decisions. Publishing raw training data may itself violate privacy, removing human review weakens redress, and outsourcing does not transfer the deploying organization's responsibility.

Question 15Foundations of Data Ethics and Ethical Theory

A deontological evaluation of a data broker selling location data would most likely focus on which question?

  1. Whether the sale is customary in the industry
  2. Whether the broker's executives possess virtuous character
  3. Whether the sale violates duties such as respecting autonomy and keeping promises regardless of profit Correct answer.
  4. Whether the sale produces the greatest total happiness

Explanation

Deontology assesses actions against duties and rules, such as honoring consent agreements and respecting persons, independent of consequences. Profit maximization is consequentialist, character assessment is virtue ethics, and industry custom is a descriptive appeal that carries no deontic weight.

Question 16Foundations of Data Ethics and Ethical Theory

What is the core ethical concern with using 'dark patterns' in consent interfaces?

  1. They reduce the amount of data stored on servers
  2. They improve the accuracy of machine learning models
  3. They manipulate users into choices they would not make with clear, neutral presentation Correct answer.
  4. They increase the visual appeal of a website

Explanation

Dark patterns exploit cognitive biases through misleading wording, hidden options, or repeated prompts, undermining the voluntariness and comprehension that valid consent requires. Aesthetics, storage reduction, and model accuracy are unrelated to this manipulation concern.

Question 17Foundations of Data Ethics and Ethical Theory

Which statement correctly distinguishes transparency from explainability in algorithmic governance?

  1. Transparency and explainability are identical and always achieved by the same measure
  2. Transparency concerns only source code publication; explainability concerns only user interface design
  3. Transparency discloses that and how a system is used; explainability concerns whether the reasons for specific outputs can be understood Correct answer.
  4. Transparency applies only to public bodies; explainability applies only to private firms

Explanation

Transparency is about openness regarding a system's existence, purpose, and processes, while explainability concerns the ability to render the basis of particular decisions intelligible to affected parties. They are related but distinct goals, and neither is confined to a sector or a single mechanism.

Question 18Foundations of Data Ethics and Ethical Theory

A research team wants to reuse archived social media posts for a study on mental health. Which safeguard most directly addresses the ethical risk of harm to the original posters?

  1. Removing the institutional review board from the process to speed approval
  2. Publishing the raw dataset to enable replication
  3. Increasing the sample size to improve statistical power
  4. Reviewing foreseeable harms and avoiding verbatim quotation that could identify vulnerable individuals Correct answer.

Explanation

Because posts may reveal sensitive information and identities, harm mitigation requires anticipating risks such as re-identification and stigmatization and adjusting quotation and reporting practices. Sample size and full data release do not address participant welfare, and bypassing review removes a key safeguard.

Question 19Foundations of Data Ethics and Ethical Theory

Which principle of the GDPR-style framework requires that personal data be kept accurate and, where necessary, up to date?

  1. Accountability
  2. Storage limitation
  3. Lawfulness
  4. Accuracy Correct answer.

Explanation

The accuracy principle obliges controllers to ensure personal data are correct and to rectify or erase inaccurate data without undue delay. Storage limitation concerns retention periods, lawfulness concerns legal basis, and accountability concerns demonstrating compliance.

Question 20Foundations of Data Ethics and Ethical Theory

A company's ethics board debates whether to deploy a model that improves outcomes overall but harms a small, already disadvantaged group. Which analytical approach best fits a Rawlsian lens?

  1. Evaluate whether the decision respects the executives' virtues
  2. Evaluate whether total net benefit is maximized across all groups
  3. Evaluate whether the arrangement benefits the least advantaged group Correct answer.
  4. Evaluate whether the decision follows prevailing market practice

Explanation

A Rawlsian analysis applies a difference principle, judging institutions by whether they improve the position of the worst-off. Total net benefit is utilitarian, executive virtue is virtue ethics, and market practice is a descriptive standard that Rawlsian reasoning would not treat as authoritative.

Question 21Foundations of Data Ethics and Ethical Theory

Which argument most directly challenges the claim that anonymized data falls outside ethical scrutiny?

  1. Anonymized data are always too low in quality for research
  2. Anonymized data cannot be stored in cloud environments
  3. Residual re-identification risk means anonymized records can still affect identifiable individuals Correct answer.
  4. Anonymization is prohibited by all data protection laws

Explanation

Even robustly de-identified data carry some re-identification risk and can inform decisions that affect real people, so ethical duties can persist beyond anonymization. Claims about quality, universal prohibition, or cloud storage are inaccurate generalizations.

Question 22Foundations of Data Ethics and Ethical Theory

A team uses a proxy variable such as postcode in a credit model. Why does this raise a fairness concern even when race is excluded?

  1. Excluding race guarantees the model is fair
  2. The proxy may encode group membership and reproduce discriminatory patterns indirectly Correct answer.
  3. Proxy variables always improve model interpretability
  4. Postcode is a uniquely reliable measure of creditworthiness

Explanation

Proxies can correlate strongly with protected characteristics because of historical segregation or inequality, so discrimination can persist through indirect channels. Removing an explicit attribute does not guarantee fairness, and a proxy's predictive value does not make its use ethically neutral.

Question 23Foundations of Data Ethics and Ethical Theory

Which critique best captures the limitation of a purely compliance-based approach to data ethics?

  1. Compliance frameworks are always stricter than ethical standards
  2. Compliance eliminates the need for ethical judgment in every case
  3. Legal compliance sets a minimum floor and may not resolve novel or ambiguous ethical harms Correct answer.
  4. Legal rules are irrelevant to data ethics

Explanation

Law often lags behind technological change and codifies minimum requirements, leaving ethical judgment necessary for cases law does not clearly address. Compliance is not always stricter than ethics, does not replace judgment, and law remains a relevant baseline.

Question 24Foundations of Data Ethics and Ethical Theory

A model's designers argue that because they did not intend to discriminate, they bear no responsibility for biased outputs. Which response best reflects ethical reasoning about responsibility?

  1. Foreseeable harms can generate responsibility regardless of intent, especially when testing could have revealed them Correct answer.
  2. Responsibility belongs solely to the data subjects
  3. Intent is the only relevant factor in assigning responsibility
  4. Responsibility disappears once the model is open-sourced

Explanation

Ethical responsibility extends to foreseeable consequences that a reasonably diligent developer could have detected and mitigated, even absent discriminatory intent. Treating intent as the sole criterion ignores negligence, and open-sourcing does not dissolve the duties of those who built and released the system.

Question 25Foundations of Data Ethics and Ethical Theory

Which ethical framework would most naturally justify whistleblowing on a data practice that secretly violates users' consent?

  1. Deontology, because it may be a duty to disclose wrongdoing regardless of personal cost Correct answer.
  2. Fatalism, because outcomes are predetermined and action is pointless
  3. Egoism, because disclosure maximizes the whistleblower's self-interest
  4. Relativism, because the practice is acceptable if the local culture tolerates it

Explanation

Deontological reasoning can ground a duty to expose serious wrongdoing even when disclosure is personally costly. Egoism would typically counsel against self-sacrifice, relativism would defer to local norms, and fatalism denies the point of action rather than justifying it.

Question 26Foundations of Data Ethics and Ethical Theory

In data ethics, the principle of 'informed consent' requires that individuals be given which of the following before their personal data is collected?

  1. A guarantee that their data will never be shared with any third party
  2. A clear explanation of how their data will be used and the ability to refuse without penalty Correct answer.
  3. A promise that their data will be deleted within 24 hours
  4. A financial payment for each use of their data

Explanation

Informed consent means individuals understand the purpose, risks, and benefits of data collection and voluntarily agree, with the option to decline. It does not require payment, absolute non-sharing, or immediate deletion, which are separate issues.

Question 27Foundations of Data Ethics and Ethical Theory

Which ethical theory evaluates the rightness of an action solely by its consequences, such as maximizing overall well-being?

  1. Virtue ethics
  2. Consequentialism Correct answer.
  3. Ethics of care
  4. Deontology

Explanation

Consequentialism holds that the moral quality of an action is determined by its outcomes, with utilitarianism being a prominent example that seeks to maximize overall welfare. Deontology focuses on duties and rules, virtue ethics on character, and ethics of care on relationships and responsiveness.

Question 28Foundations of Data Ethics and Ethical Theory

A data scientist is asked to build a model that predicts employee turnover. She discovers that including ZIP code as a feature improves accuracy but also encodes racial segregation patterns from historical housing policies. Applying the principle of justice as fairness, what should she do?

  1. Include ZIP code because accuracy is the primary goal of any model
  2. Keep ZIP code but add a disclaimer that the model may be biased
  3. Remove ZIP code and document why it was excluded to prevent proxy discrimination Correct answer.
  4. Replace ZIP code with individual race data to measure bias directly

Explanation

Justice as fairness requires avoiding features that perpetuate systemic inequities, even if they boost accuracy. Removing the proxy and documenting the decision supports accountability and prevents disparate impact. Including race directly would not fix the underlying unfairness and may create new legal and ethical problems.

Question 29Foundations of Data Ethics and Ethical Theory

Which statement best explains why 'data privacy' and 'data security' are distinct concepts in data ethics?

  1. Privacy is a legal requirement, whereas security is an ethical aspiration
  2. Security is about protecting data from unauthorized access, while privacy is about the appropriate use and control of personal information Correct answer.
  3. Security guarantees privacy if implemented correctly
  4. Privacy concerns only apply to personal data, while security applies to all data

Explanation

Data security focuses on protecting data from breaches and unauthorized access through technical measures. Privacy is broader, concerning individuals' control over how their personal information is collected, used, and shared, including lawful and ethical use even when data is secure.

Question 30Foundations of Data Ethics and Ethical Theory

A company uses an algorithm to screen job applicants. The algorithm is trained on historical hiring data that reflects past discrimination against women. Which ethical concept best describes the algorithm's tendency to reproduce this discrimination?

  1. Purpose limitation
  2. Informed consent
  3. Algorithmic bias Correct answer.
  4. Data minimization

Explanation

Algorithmic bias occurs when a model systematically produces unfair outcomes due to biased training data or design choices. Data minimization, purpose limitation, and informed consent are principles about data handling, not about discriminatory model outputs.

Question 31Privacy, Data Protection, and Individual Rights

Under the GDPR, which legal basis requires the data subject's consent to be freely given, specific, informed, and unambiguous, expressed by a statement or clear affirmative action?

  1. Legitimate interests under Article 6(1)(f)
  2. Performance of a contract under Article 6(1)(b)
  3. Compliance with a legal obligation under Article 6(1)(c)
  4. Consent under Article 6(1)(a) Correct answer.

Explanation

Article 6(1)(a) makes consent a lawful basis and Article 4(11) defines it as any freely given, specific, informed and unambiguous indication of wishes given by statement or clear affirmative action. The other bases do not depend on the data subject's permission at all.

Question 32Privacy, Data Protection, and Individual Rights

A data subject asks a company to delete the personal data it holds about her. Which right under the GDPR is she exercising?

  1. Right to data portability
  2. Right to restriction of processing
  3. Right to rectification
  4. Right to erasure Correct answer.

Explanation

The right to erasure, often called the right to be forgotten, is set out in Article 17 and allows the data subject to obtain deletion of personal data without undue delay where a ground applies. Rectification corrects inaccurate data, portability transfers data, and restriction only limits how data is used.

Question 33Privacy, Data Protection, and Individual Rights

Which term describes the principle that personal data should be collected only for specified, explicit, and legitimate purposes and not further processed in incompatible ways?

  1. Integrity and confidentiality
  2. Purpose limitation Correct answer.
  3. Storage limitation
  4. Data minimisation

Explanation

Purpose limitation is a core GDPR principle requiring that data be collected for specified, explicit and legitimate purposes and not further processed incompatibly. Data minimisation concerns how much is collected, storage limitation concerns how long it is kept, and integrity and confidentiality concerns security.

Question 34Privacy, Data Protection, and Individual Rights

A person photographs a passer-by's face on a public street and stores the image on a phone. Which statement best reflects how the GDPR treats this?

  1. The image is personal data because it identifies or can identify a natural person Correct answer.
  2. The GDPR applies only if the image is later sold
  3. The GDPR never applies to images captured in public places
  4. The image is anonymous data because no name is recorded

Explanation

Personal data under Article 4(1) covers any information relating to an identified or identifiable natural person, and a facial image is biometric-capable information that can identify someone. The GDPR has no general public-space exemption for personal photography, and lack of a name does not make data anonymous.

Question 35Privacy, Data Protection, and Individual Rights

Which of the following is a special category of personal data under Article 9 of the GDPR?

  1. Employment history
  2. Financial account numbers
  3. Racial or ethnic origin Correct answer.
  4. Postal address

Explanation

Article 9 lists special categories including racial or ethnic origin, political opinions, religious beliefs, health, sex life or sexual orientation, and biometric and genetic data. Processing these is prohibited unless a specific exception applies. Financial data, employment history, and addresses are ordinary personal data.

Question 36Privacy, Data Protection, and Individual Rights

Under the GDPR, who is the 'controller' of personal data?

  1. The supervisory authority that oversees compliance
  2. The natural or legal person that determines the purposes and means of processing Correct answer.
  3. The data subject whose data is processed
  4. The natural or legal person that processes data on behalf of another

Explanation

Article 4(7) defines the controller as the entity that alone or jointly with others determines the purposes and means of processing. The processor acts on the controller's behalf, the supervisory authority regulates, and the data subject is the individual concerned.

Question 37Privacy, Data Protection, and Individual Rights

Which principle requires that personal data be processed in a manner that ensures appropriate security, including protection against unauthorised processing using technical and organisational measures?

  1. Accuracy
  2. Accountability
  3. Integrity and confidentiality Correct answer.
  4. Lawfulness, fairness and transparency

Explanation

Integrity and confidentiality under Article 5(1)(f) requires appropriate technical and organisational measures to secure data against unauthorised or unlawful processing and against loss or damage. Accuracy concerns correctness of data, and accountability concerns demonstrating compliance.

Question 38Privacy, Data Protection, and Individual Rights

A company wants to transfer personal data from the EU to a service provider in a third country. Which mechanism can lawfully support such a transfer under the GDPR?

  1. Approval by the data subject's line manager
  2. A verbal promise from the foreign provider to be careful
  3. A note in the company's internal privacy policy
  4. An adequacy decision or appropriate safeguards such as standard contractual clauses Correct answer.

Explanation

Chapter V permits transfers based on an adequacy decision or, absent one, appropriate safeguards such as standard contractual clauses or binding corporate rules, with possible supplementary measures. Informal promises, internal policies, or managerial approval are not recognised transfer tools.

Question 39Privacy, Data Protection, and Individual Rights

A marketing team wants to send promotional emails to a list of customers. Under the GDPR and the ePrivacy Directive, what is the general requirement for contacting individuals by electronic means?

  1. Consent is needed only if the recipient has previously objected
  2. No consent is needed because marketing is a legitimate interest
  3. Prior consent is required unless a narrow soft opt-in exception applies Correct answer.
  4. Consent is only needed for postal mail

Explanation

The ePrivacy Directive requires prior consent for unsolicited electronic marketing, subject to a limited soft opt-in for existing customers where the product is similar and an opt-out is offered. Legitimate interests alone does not override the electronic marketing consent rule.

Question 40Privacy, Data Protection, and Individual Rights

An organisation receives a data subject access request. Under the GDPR, within what period must the controller generally respond?

  1. Within 72 hours
  2. Within six months
  3. Without undue delay and in any event within one month, extendable by two further months for complex requests Correct answer.
  4. Within 48 hours

Explanation

Article 12(3) requires the controller to provide information on action taken without undue delay and at the latest within one month, with a possible extension of two further months where requests are complex or numerous. The 72-hour period relates to breach notification, not access requests.

Question 41Privacy, Data Protection, and Individual Rights

A bank discovers a personal data breach that is likely to result in a risk to individuals' rights and freedoms. What must the bank generally do under the GDPR?

  1. Notify only the affected customers and no authority
  2. Wait until the annual report to disclose the breach
  3. Notify the supervisory authority within 30 days
  4. Notify the supervisory authority without undue delay and where feasible within 72 hours of becoming aware Correct answer.

Explanation

Article 33 requires notification to the competent supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware, unless the breach is unlikely to result in a risk. Where the risk is high, Article 34 also requires communication to affected individuals.

Question 42Privacy, Data Protection, and Individual Rights

Which statement best describes the GDPR principle of data minimisation?

  1. Data must be deleted as soon as it is collected
  2. Data must be stored for at least one year
  3. Only data adequate, relevant, and limited to what is necessary for the purposes may be processed Correct answer.
  4. All data must be encrypted at rest

Explanation

Article 5(1)(c) requires personal data to be adequate, relevant and limited to what is necessary in relation to the purposes. It does not impose minimum retention, a universal encryption rule, or immediate deletion.

Question 43Privacy, Data Protection, and Individual Rights

A controller engages a cloud vendor to host personal data. What must the arrangement include to satisfy Article 28 of the GDPR?

  1. Only a clause allowing the vendor to use the data for its own marketing
  2. A binding contract with processor obligations, including processing only on documented instructions and ensuring confidentiality and security Correct answer.
  3. A public blog post announcing the partnership
  4. A verbal agreement that the vendor will follow the law

Explanation

Article 28 requires a written contract binding the processor to act only on the controller's documented instructions and to implement security, confidentiality, and assistance obligations. A verbal agreement, publicity, or self-serving vendor rights do not satisfy these requirements.

Question 44Privacy, Data Protection, and Individual Rights

A data subject objects to processing based on legitimate interests. What is the controller generally required to do?

  1. Stop processing unless it demonstrates compelling legitimate grounds that override the individual's interests, rights, and freedoms Correct answer.
  2. Transfer the data to a third party
  3. Continue processing because legitimate interests always prevail
  4. Charge the data subject a fee for the objection

Explanation

Article 21 gives the data subject the right to object to processing based on legitimate interests, after which the controller must cease unless it demonstrates compelling legitimate grounds that override the individual's interests. For direct marketing, the objection is absolute.

Question 45Privacy, Data Protection, and Individual Rights

Which of the following best describes 'privacy by design' as reflected in Article 25 of the GDPR?

  1. Encrypting data only after a breach occurs
  2. Adding a privacy notice at the end of a project
  3. Assigning privacy duties only to the legal department
  4. Integrating data protection measures into the design of processing activities and by default Correct answer.

Explanation

Article 25 requires the controller to implement appropriate technical and organisational measures, such as pseudonymisation, designed to implement data protection principles effectively and to integrate safeguards by default. It is a proactive engineering obligation, not a documentation afterthought.

Question 46Privacy, Data Protection, and Individual Rights

A company processes health data of employees for occupational health purposes. Which Article 9 condition is most relevant?

  1. The data will be anonymised later
  2. Processing is necessary for the purposes of preventive or occupational medicine and assessment of working capacity Correct answer.
  3. The employee has signed a generic waiver
  4. The employer has a legitimate interest in monitoring staff

Explanation

Article 9(2)(h) permits processing of special category data where necessary for preventive or occupational medicine, medical diagnosis, and assessment of working capacity under professional secrecy. A generic waiver is not valid consent, and legitimate interests cannot lift the Article 9 prohibition.

Question 47Privacy, Data Protection, and Individual Rights

What does the right to data portability under Article 20 generally allow a data subject to do?

  1. Require the controller to anonymise the data
  2. Receive personal data provided to a controller in a structured, commonly used, machine-readable format and transmit it to another controller Correct answer.
  3. Prevent any processing of their data forever
  4. Demand deletion of all data held by the controller

Explanation

Article 20 lets the data subject receive data they provided in a structured, commonly used and machine-readable format and transmit it to another controller where processing is based on consent or contract and carried out by automated means. It is not a deletion or blocking right.

Question 48Privacy, Data Protection, and Individual Rights

A controller wants to rely on consent obtained from a child for an online service. Under the GDPR, what is the default age below which parental consent is required, subject to Member State variation?

  1. 16 years Correct answer.
  2. 21 years
  3. 18 years
  4. 13 years

Explanation

Article 8 sets the default age at 16 for information society services offered directly to a child, although Member States may lower it to no less than 13. The controller must make reasonable efforts to verify parental consent where required.

Question 49Privacy, Data Protection, and Individual Rights

A retailer uses automated processing to decide whether applicants get credit, with no human involvement. Which GDPR provision is most directly engaged?

  1. The right to data portability
  2. The right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects Correct answer.
  3. The household exemption
  4. The freedom of expression derogation

Explanation

Article 22 protects individuals from decisions based solely on automated processing, including profiling, that produce legal effects or similarly significantly affect them, subject to exceptions and safeguards. Credit decisions are a classic example of such significant effects.

Question 50Privacy, Data Protection, and Individual Rights

A controller wants to demonstrate accountability. Which action best supports this under Article 5(2) and Article 24?

  1. Maintaining records of processing activities and appropriate policies and technical measures Correct answer.
  2. Avoiding any written data protection policy
  3. Deleting all documentation after each project
  4. Relying on verbal assurances from staff

Explanation

Accountability requires the controller to be able to demonstrate compliance, typically through records of processing, policies, impact assessments, and appropriate technical and organisational measures. Verbal assurances and the absence of documentation undermine that demonstration.