I85PREP
⌘ K
ICDL Data Protection study materials
ICDL Data Protection study resources

ICDL Data Protection (ICDL) practice questions

One question at a time. Build your ICDL Data Protection understanding.

First 50 of 194 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Data Protection Concepts

Which term describes information that can identify a living person, either on its own or when combined with other data?

  1. Aggregated statistics
  2. Metadata
  3. Personal data Correct answer.
  4. Anonymised data

Explanation

Personal data is any information relating to an identified or identifiable natural person. The key test is whether the person can be identified, directly or indirectly. Data that cannot be linked back to a person falls outside this definition.

Question 2Data Protection Concepts

A company stores customer records. Which of the following is a data controller?

  1. The external payroll firm processing salaries on the company's instructions
  2. The cloud provider hosting the database
  3. The organisation that decides why and how the customer data is processed Correct answer.
  4. An employee who types the records into the system

Explanation

The controller is the entity that determines the purposes and means of processing personal data. Processors act on the controller's behalf and follow its instructions. Employees and hosting providers act within arrangements set by others.

Question 3Data Protection Concepts

What is the main purpose of a data protection impact assessment (DPIA)?

  1. To calculate the financial cost of a data breach
  2. To record employee training completion
  3. To register the organisation with a supervisory authority
  4. To identify and reduce risks before starting high-risk processing Correct answer.

Explanation

A DPIA is carried out before processing that is likely to result in a high risk to individuals. It identifies risks and the measures needed to mitigate them. It is a forward-looking risk tool, not a cost or registration exercise.

Question 4Data Protection Concepts

Which principle requires that personal data be kept no longer than necessary for the purpose it was collected?

  1. Storage limitation Correct answer.
  2. Integrity and confidentiality
  3. Lawfulness
  4. Accuracy

Explanation

Storage limitation requires data to be kept in identifiable form only as long as needed for the stated purpose. Accuracy concerns correctness of the data, while lawfulness concerns the legal basis. Integrity and confidentiality concern security of processing.

Question 5Data Protection Concepts

Under the principle of purpose limitation, personal data collected for one purpose may generally be used for another purpose only when:

  1. The new purpose is compatible with the original purpose or a legal basis permits it Correct answer.
  2. The data is stored in a secure system
  3. The data subject is a business rather than a consumer
  4. The organisation has more than 250 employees

Explanation

Purpose limitation restricts processing to the purposes for which data was collected unless a further use is compatible or separately authorised by law. Security measures and company size do not create new permitted purposes.

Question 6Data Protection Concepts

What does the right of access allow an individual to obtain?

  1. A copy of their personal data and information about how it is processed Correct answer.
  2. Deletion of all records held about them
  3. Compensation for any past processing
  4. Ownership of the organisation's database

Explanation

The right of access lets individuals confirm whether their data is processed and receive a copy plus details such as purposes and recipients. Deletion is a separate right, and access does not transfer ownership of systems.

Question 7Data Protection Concepts

Which of the following best describes a data processor?

  1. The authority that enforces data protection law
  2. The person whose data is being collected
  3. A party that processes personal data on behalf of the controller Correct answer.
  4. The entity that decides the purpose of processing

Explanation

A processor handles personal data on behalf of and under the instructions of the controller. The controller decides the purposes and means. The data subject is the individual the data concerns.

Question 8Data Protection Concepts

Which legal basis relies on the individual's clear affirmative agreement to processing for a specific purpose?

  1. Vital interest
  2. Consent Correct answer.
  3. Contract performance
  4. Legitimate interest

Explanation

Consent is a freely given, specific, informed and unambiguous indication of agreement. Legitimate interest and contract performance are separate legal bases that do not depend on the individual's agreement.

Question 9Data Protection Concepts

A marketing team wants to email existing customers about a new service. Which action best reflects the principle of transparency?

  1. Burying the notice in a long contract signed years earlier
  2. Collecting the data silently and explaining later only if asked
  3. Telling customers clearly what data is used and why, at the point of collection Correct answer.
  4. Sharing the data with partners without informing customers

Explanation

Transparency requires clear, accessible information about processing given at the appropriate time. Hidden or retrospective disclosure does not meet this standard.

Question 10Data Protection Concepts

An organisation receives a request from a customer to correct a misspelled surname in its records. Which right is being exercised?

  1. Right to portability
  2. Right to erasure
  3. Right to restrict processing
  4. Right to rectification Correct answer.

Explanation

Rectification allows individuals to have inaccurate personal data corrected. Erasure concerns deletion, portability concerns receiving data in a portable format, and restriction concerns limiting use.

Question 11Data Protection Concepts

Which situation most likely requires a data protection officer to be appointed?

  1. A sole trader who keeps a paper address book
  2. A clinic that processes health data on a large scale as a core activity Correct answer.
  3. A small bakery that only keeps staff rota details
  4. A hobby club that stores members' email addresses

Explanation

A DPO is generally required where processing is a core activity involving large-scale systematic monitoring or large-scale special category data such as health data. Small-scale routine processing normally does not trigger the requirement.

Question 12Data Protection Concepts

A retailer wants to send a customer's purchase history to a courier so the parcel can be delivered. Which statement is correct?

  1. The courier acts as a processor and should be bound by a written contract Correct answer.
  2. No safeguards are needed because delivery is a routine task
  3. This is a sale of data requiring the customer's separate consent
  4. The retailer becomes a processor once data is shared

Explanation

A courier processing data solely to deliver a parcel acts as a processor and must be governed by a contract setting out its obligations. Sharing for delivery does not turn the retailer into a processor.

Question 13Data Protection Concepts

What does the principle of data minimisation require?

  1. Collecting as much data as possible for future use
  2. Encrypting all data at rest
  3. Collecting only the data adequate and relevant to the stated purpose Correct answer.
  4. Deleting all data within 24 hours

Explanation

Data minimisation requires that personal data be adequate, relevant and limited to what is necessary for the purpose. Collecting extra data for undefined future use conflicts with this principle.

Question 14Data Protection Concepts

A company discovers a breach that is likely to result in a risk to individuals. What is the typical obligation toward the supervisory authority?

  1. Notify only if a lawsuit is filed
  2. Notify it without undue delay, generally within 72 hours of becoming aware Correct answer.
  3. Wait until the annual report is published
  4. Notify after all affected individuals have been compensated

Explanation

Where a breach is likely to result in a risk to individuals, the controller must notify the supervisory authority without undue delay, generally within 72 hours of awareness. Delay is only acceptable where the notification is accompanied by reasons.

Question 15Data Protection Concepts

Which of the following is a special category of personal data that generally requires extra protection?

  1. A person's job title
  2. A company's office address
  3. A product's serial number
  4. A person's health information Correct answer.

Explanation

Special categories include health data and other sensitive types such as racial or ethnic origin, and processing them generally requires an additional condition. Job titles and business addresses are ordinary data.

Question 16Data Protection Concepts

An individual asks an online service to transfer their account data to a competing provider in a machine-readable format. Which right applies?

  1. Right to be informed
  2. Right to object
  3. Right to restriction
  4. Right to data portability Correct answer.

Explanation

Portability allows individuals to receive their data in a structured, commonly used, machine-readable format and to have it transmitted to another controller where processing is based on consent or contract.

Question 17Data Protection Concepts

Which practice best supports the principle of accuracy?

  1. Keeping all records indefinitely to preserve history
  2. Sharing records widely so others can check them
  3. Encrypting records so errors cannot be seen
  4. Updating records promptly when an individual reports a change of address Correct answer.

Explanation

Accuracy requires that personal data be accurate and, where necessary, kept up to date. Acting promptly on reported changes supports this. Retention, encryption and wide sharing do not by themselves ensure accuracy.

Question 18Data Protection Concepts

An organisation relies on legitimate interests as its legal basis. What must it do before processing?

  1. Obtain written consent from every individual
  2. Register the processing with a trade body
  3. Publish the personal data on its website
  4. Carry out a balancing assessment of its interests against individuals' rights Correct answer.

Explanation

Relying on legitimate interests requires a three-part assessment: a legitimate interest, necessity of processing, and a balancing of that interest against individuals' rights and freedoms. Consent is not required when this basis is validly used.

Question 19Data Protection Concepts

Which statement best explains the relationship between accountability and other data protection principles?

  1. Accountability replaces the need to follow other principles
  2. Accountability requires the controller to demonstrate compliance with the principles Correct answer.
  3. Accountability is optional for small businesses
  4. Accountability applies only to public sector bodies

Explanation

Accountability makes the controller responsible for complying with the principles and able to demonstrate that compliance, for example through records and policies. It reinforces rather than replaces the other principles.

Question 20Data Protection Concepts

A hospital shares patient records with a research institute. Which factor is most important in deciding whether this is permitted?

  1. Whether the research institute has a larger budget
  2. Whether the records are stored on paper or electronically
  3. Whether the patients live in the same city
  4. Whether a valid legal basis and any required safeguards apply to the new purpose Correct answer.

Explanation

Sharing for a new purpose such as research requires a valid legal basis and appropriate safeguards, and the new use must be compatible or separately authorised. Budget, storage medium and location are not the determining factors.

Question 21Data Protection Concepts

An organisation pseudonymises a dataset by replacing names with codes but keeps the mapping key. How should this data be treated?

  1. As special category data in all cases
  2. As fully anonymised data outside data protection law
  3. As non-personal data because names are removed
  4. As personal data, because individuals can still be re-identified using the key Correct answer.

Explanation

Pseudonymised data remains personal data because re-identification is still possible with additional information such as the mapping key. Only irreversible anonymisation removes data from scope.

Question 22Data Protection Concepts

A controller receives an erasure request but is legally required to retain the records for tax purposes. What is the appropriate response?

  1. Ignore the request until the retention period ends
  2. Refuse erasure for the retained records and explain the legal retention obligation Correct answer.
  3. Transfer the records to a marketing database
  4. Delete the records immediately to satisfy the request

Explanation

The right to erasure is not absolute and does not override legal obligations to retain data, such as tax law. The controller should explain the applicable retention obligation and erase any data not covered by it.

Question 23Data Protection Concepts

Which scenario best illustrates the principle of integrity and confidentiality?

  1. Collecting extra data in case it is useful later
  2. Restricting access to personal data to authorised staff and encrypting it Correct answer.
  3. Publishing all customer records to improve transparency
  4. Keeping data indefinitely to preserve its integrity

Explanation

Integrity and confidentiality require appropriate security, including protection against unauthorised access and accidental loss. Access controls and encryption are typical measures. Publishing data or over-collecting undermines protection.

Question 24Data Protection Concepts

A company wants to rely on consent for processing. Which situation would most likely undermine the validity of that consent?

  1. Consent is requested separately for each distinct purpose
  2. Individuals can withdraw consent as easily as they gave it
  3. Consent is recorded with a date and time
  4. Employees feel pressured to consent to monitoring by their manager Correct answer.

Explanation

Valid consent must be freely given; pressure from a manager in an unequal relationship can make consent invalid. Separate requests, records of consent, and easy withdrawal all support validity.

Question 25Data Protection Concepts

Which statement about the relationship between a controller and a processor is accurate when the processor suffers a breach?

  1. The processor must notify the controller without undue delay Correct answer.
  2. The processor has no obligations because it does not own the data
  3. The processor must publish the breach on its website
  4. The processor must notify the affected individuals directly and never the controller

Explanation

A processor must notify the controller without undue delay after becoming aware of a breach. The controller then assesses risk and decides on notifications to the authority or individuals.

Question 26Data Protection Concepts

Which term describes information that relates to an identified or identifiable living person?

  1. Anonymised data
  2. Metadata
  3. Aggregated statistics
  4. Personal data Correct answer.

Explanation

Personal data is any information relating to an identified or identifiable natural person. Anonymised data and aggregate statistics do not identify individuals, so they fall outside this definition.

Question 27Data Protection Concepts

Under the data protection principles, for how long should personal data generally be kept?

  1. Indefinitely once collected lawfully
  2. Until the individual turns 18
  3. No longer than necessary for the stated purpose Correct answer.
  4. For a minimum of ten years

Explanation

The storage limitation principle requires that personal data be kept no longer than is necessary for the purposes for which it is processed. Retention periods should be defined and justified rather than fixed by age or arbitrary minimums.

Question 28Data Protection Concepts

What is the primary role of a data controller?

  1. Auditing other organisations for compliance
  2. Physically storing the servers that hold personal data
  3. Determining the purposes and means of processing personal data Correct answer.
  4. Writing software that encrypts personal data

Explanation

A controller is the entity that decides why and how personal data is processed. Processors, hosting providers and auditors act on the controller's instructions rather than setting the purpose.

Question 29Data Protection Concepts

Which of the following is an example of a data subject?

  1. A company that owns the loyalty database
  2. A customer whose address is stored in a shop's loyalty database Correct answer.
  3. A regulator that inspects the loyalty database
  4. A clerk who enters customer addresses into the database

Explanation

A data subject is the individual to whom personal data relates. Staff entering data, the owning company and regulators act on or oversee the data but are not the subject of it.

Question 30Data Protection Concepts

What does the principle of purpose limitation require?

  1. Data should be stored in a single purpose-built database
  2. Data should be deleted once a purpose is written down
  3. Data should be processed only by the purpose owner
  4. Data should be collected for specified, explicit and legitimate purposes Correct answer.

Explanation

Purpose limitation means personal data must be collected for specified, explicit and legitimate purposes and not used incompatibly afterwards. It concerns the stated reason for processing, not the physical storage arrangement.

Question 31Data Protection Concepts

Which statement best describes the principle of lawfulness, fairness and transparency?

  1. Processing must have a valid legal basis and be handled openly and justly toward individuals Correct answer.
  2. Processing must be fair to competitors in the same market
  3. Processing must always be approved by a court before it begins
  4. Processing must be lawful only in the country where the data is stored

Explanation

This principle combines three requirements: a lawful basis for processing, fair treatment of individuals and openness about how data is used. It does not require prior court approval or relate to market competition.

Question 32Data Protection Concepts

What is a privacy notice primarily intended to do?

  1. Transfer ownership of personal data to the organisation
  2. Obtain a signature confirming consent to all processing
  3. Inform individuals about how their personal data will be used Correct answer.
  4. Replace the need for a legal basis

Explanation

A privacy notice provides transparent information such as purposes, legal basis, recipients and rights. It supports transparency but does not itself create consent, ownership or a legal basis.

Question 33Data Protection Concepts

Which of the following is personal data?

  1. A work email address containing a person's name Correct answer.
  2. A national inflation rate
  3. A company's published annual report
  4. A generic product code

Explanation

An email address that identifies a specific person relates to an identifiable individual and is therefore personal data. Company reports, economic statistics and product codes do not identify people.

Question 34Data Protection Concepts

An organisation collects only a customer's email address when that is all that is needed to send a receipt. Which principle does this best demonstrate?

  1. Accountability
  2. Data minimisation Correct answer.
  3. Accuracy
  4. Storage limitation

Explanation

Data minimisation requires that only adequate, relevant and necessary data be collected. Collecting just the email address needed for a receipt is a direct application of that principle.

Question 35Data Protection Concepts

A company decides to use customer data for a new purpose unrelated to the original collection. What should it assess first?

  1. Whether the new purpose is compatible with the original purpose Correct answer.
  2. Whether the data can be sold to a third party
  3. Whether the new purpose can be hidden from customers
  4. Whether the new purpose will increase revenue

Explanation

Purpose limitation requires that new uses be compatible with the purposes for which data was originally collected, or be supported by a separate lawful basis. Commercial benefit and concealment are irrelevant to that assessment.

Question 36Data Protection Concepts

Which situation best illustrates a transfer of personal data to a third country requiring additional safeguards?

  1. An EU controller emails a colleague in the same building
  2. An EU controller stores records on a server in the same member state
  3. An EU controller sends customer records to a processor whose servers are located outside the EU Correct answer.
  4. An EU controller prints customer records in its own office

Explanation

Sending personal data to a recipient or server outside the EU constitutes a transfer to a third country, which requires an adequacy decision or appropriate safeguards. Domestic processing within the same country does not raise this issue.

Question 37Data Protection Concepts

A company wants to process employee health data for occupational health purposes. Which statement is most accurate?

  1. Health data is not personal data if it is stored in a spreadsheet
  2. Health data is a special category and generally requires a specific additional condition for processing Correct answer.
  3. Health data needs no protection if the employee volunteers it
  4. Health data can be processed freely because it is collected from employees

Explanation

Health data is a special category of personal data and generally needs an additional condition, often linked to employment or health care, on top of a lawful basis. The source or storage format of the data does not change its sensitivity.

Question 38Data Protection Concepts

How does a data protection impact assessment help an organisation?

  1. It replaces the need to appoint a data protection officer
  2. It permanently exempts the organisation from regulatory oversight
  3. It identifies and mitigates risks to individuals before high-risk processing begins Correct answer.
  4. It guarantees that no data breach can occur

Explanation

A DPIA is a structured process for assessing the risks of planned high-risk processing and identifying measures to reduce them. It supports compliance but does not grant exemptions, replace other roles or eliminate risk.

Question 39Data Protection Concepts

Which statement best explains the principle of accountability?

  1. The controller must publish every processing operation on its website
  2. The controller must appoint an external auditor for each project
  3. The controller must be able to demonstrate compliance with data protection rules Correct answer.
  4. The controller must obtain approval from each data subject for every use

Explanation

Accountability requires controllers to take responsibility for compliance and to be able to show evidence of it, for example through records and policies. It does not demand public disclosure of every operation or individual approval for each use.

Question 40Data Protection Concepts

What is the main purpose of a record of processing activities?

  1. To store copies of all personal data for backup
  2. To list the names of every data subject
  3. To maintain an inventory of what personal data is processed and why Correct answer.
  4. To record the salaries of data protection staff

Explanation

A record of processing activities documents the categories of data, purposes, recipients and retention for each processing operation. It supports accountability and oversight rather than duplicating the data itself.

Question 41Data Protection Concepts

An organisation wants to use a photograph of an identifiable customer in an advertising campaign. Which consideration is most relevant?

  1. Whether the customer appears in other companies' adverts
  2. Whether a valid legal basis such as consent covers the advertising use Correct answer.
  3. Whether the photograph was taken with an expensive camera
  4. Whether the photograph is stored in colour or black and white

Explanation

An identifiable image is personal data, so using it for advertising needs a lawful basis, commonly consent for that specific use. Technical details about the image do not affect the legal analysis.

Question 42Data Protection Concepts

Which action best supports the principle of integrity and confidentiality?

  1. Publishing all personal data so anyone can verify it
  2. Restricting access to personal data to authorised staff and encrypting it Correct answer.
  3. Deleting all data at the end of each working day
  4. Storing all data on a single unsecured laptop

Explanation

Integrity and confidentiality require appropriate security measures to protect data against unauthorised access, loss or damage. Access controls and encryption are typical safeguards, whereas public disclosure or insecure storage undermines them.

Question 43Data Protection Concepts

A controller engages a processor. Which requirement is essential in their written contract?

  1. The processor may share data with anyone it chooses
  2. The processor may set its own purposes for the data
  3. The processor becomes the controller for all purposes
  4. The processor must act only on the controller's documented instructions Correct answer.

Explanation

A processor must act only on the controller's documented instructions, and this must be set out in a binding contract. A processor cannot decide its own purposes or freely redistribute the data.

Question 44Data Protection Concepts

An individual exercises the right to object to direct marketing. What is the typical consequence?

  1. The organisation must continue marketing but with anonymised names
  2. The organisation must stop using the data for direct marketing Correct answer.
  3. The organisation must delete all data it holds about the individual
  4. The organisation must transfer the data to a competitor

Explanation

Where an individual objects to processing for direct marketing, the organisation must stop that marketing. The objection is specific to marketing and does not automatically require erasure of all records or a data transfer.

Question 45Data Protection Concepts

A controller plans to rely on consent for processing. Which factor most affects whether that consent is valid?

  1. Whether the individual was genuinely free to refuse without detriment Correct answer.
  2. Whether the individual is over a certain income level
  3. Whether the consent form uses formal legal language
  4. Whether the consent was collected on paper rather than online

Explanation

Valid consent must be freely given, specific, informed and unambiguous. Freedom to refuse without detriment is central, while the format or the individual's income is irrelevant.

Question 46Data Protection Concepts

Which situation most likely indicates that an organisation is acting as a joint controller with a partner?

  1. One organisation sends an invoice to the other
  2. One organisation provides stationery to the other
  3. Both organisations jointly decide the purposes and means of a processing operation Correct answer.
  4. One organisation merely hosts data on its servers for the other

Explanation

Joint controllers are two or more entities that together determine the purposes and means of processing. Hosting, invoicing or supplying goods are ancillary activities that do not amount to joint decision-making.

Question 47Data Protection Concepts

An organisation relies on a legal obligation to process certain records. What does this most likely mean for the individual's rights?

  1. The organisation no longer needs to keep the data secure
  2. The individual loses all rights permanently
  3. All rights are automatically suspended for that data
  4. Some rights may be limited where they would prevent compliance with the legal obligation Correct answer.

Explanation

Where processing is necessary to comply with a legal obligation, certain rights may be restricted to the extent needed to meet that obligation. The restriction is limited and does not remove security duties or all rights.

Question 48Data Protection Concepts

A dataset has been pseudonymised and the mapping key is held separately with strong controls. How should this data be treated?

  1. As non-personal data because names were removed
  2. As fully anonymised data outside data protection law
  3. As public data because the codes are meaningless alone
  4. As personal data, because re-identification remains possible with the key Correct answer.

Explanation

Pseudonymised data remains personal data because it can be linked back to individuals using additional information. Only irreversible anonymisation removes data from the scope of data protection law.

Question 49Data Protection Concepts

A controller wants to rely on legitimate interests. Which combination best reflects what is required?

  1. A documented balancing test showing interests are not overridden by individuals' rights Correct answer.
  2. A signed consent form from every individual
  3. A guarantee that no individual will ever object
  4. A court order authorising the processing

Explanation

Legitimate interests require a three-part assessment: a legitimate interest, necessity of processing and a balancing against individuals' rights and expectations. Consent, court orders and guarantees against objection are not part of that test.

Question 50Data Protection Concepts

Which scenario best demonstrates a controller failing the accuracy principle?

  1. A bank keeps an outdated address on file after the customer twice confirms the new one Correct answer.
  2. A bank encrypts customer records at rest
  3. A bank deletes records once the retention period ends
  4. A bank restricts access to records to authorised staff

Explanation

Accuracy requires that personal data be correct and, where necessary, kept up to date. Ignoring confirmed corrections leaves inaccurate data in use, whereas encryption, access control and timely deletion support other principles.