I85PREP
⌘ K
EXIN PDPP study materials
EXIN PDPP study resources

EXIN PDPP practice questions

One question at a time. Build your EXIN PDPP understanding.

First 50 of 197 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Privacy and Data Protection Fundamentals

Under the GDPR, which role decides the purposes and means of processing personal data?

  1. The data subject
  2. The controller Correct answer.
  3. The processor
  4. The supervisory authority

Explanation

The controller is the entity that determines why and how personal data is processed, which is the defining criterion in the GDPR. Processors act only on the controller's documented instructions. Supervisory authorities oversee compliance, and data subjects are the individuals the data concerns.

Question 2Privacy and Data Protection Fundamentals

Which statement best describes the principle of purpose limitation?

  1. Personal data may be processed freely once the data subject has been informed
  2. Personal data must always be stored inside the European Union
  3. Personal data may be kept indefinitely as long as it is secure
  4. Personal data must be collected for specified, explicit and legitimate purposes and not reused incompatibly Correct answer.

Explanation

Purpose limitation requires that data be collected for specified, explicit and legitimate purposes and not further processed in a way incompatible with those purposes. Informing the data subject does not remove the need for a lawful basis and compatible use. Storage location is a separate transfer question, and indefinite retention conflicts with storage limitation.

Question 3Privacy and Data Protection Fundamentals

A company wants to rely on consent as its lawful basis for processing. Which characteristic must that consent have under the GDPR?

  1. It must be given in writing and signed by the data subject
  2. It must be renewed every month
  3. It must be approved by the supervisory authority
  4. It must be freely given, specific, informed and unambiguous Correct answer.

Explanation

Valid consent must be freely given, specific, informed and unambiguous, expressed by a statement or clear affirmative action. A written signature is one possible form but is not a universal requirement, and no fixed monthly renewal or regulator approval exists.

Question 4Privacy and Data Protection Fundamentals

Which of the following is a special category of personal data under the GDPR?

  1. A company's registration number
  2. A person's business email address
  3. A person's trade union membership Correct answer.
  4. A person's job title

Explanation

Special categories include data revealing racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic and biometric data, health data, and data concerning sex life or sexual orientation. Business contact details and job titles are ordinary personal data.

Question 5Privacy and Data Protection Fundamentals

What is the primary purpose of the data protection impact assessment (DPIA)?

  1. To replace the need for a lawful basis
  2. To register the company with the tax authority
  3. To identify and mitigate high risks to individuals before processing begins Correct answer.
  4. To calculate the financial value of a dataset

Explanation

A DPIA is a structured process to assess and reduce risks that a processing operation poses to individuals' rights and freedoms. It is required where processing is likely to result in a high risk. It does not replace a lawful basis or serve financial or tax purposes.

Question 6Privacy and Data Protection Fundamentals

Which right allows an individual to obtain a copy of the personal data a company holds about them?

  1. Right to restriction
  2. Right to rectification
  3. Right to erasure
  4. Right of access Correct answer.

Explanation

The right of access lets a data subject obtain confirmation of whether their data is processed and receive a copy of it. Rectification corrects inaccurate data, erasure removes data, and restriction limits processing.

Question 7Privacy and Data Protection Fundamentals

What does the accountability principle require of an organisation?

  1. It must obtain consent for every processing activity
  2. It must appoint a data protection officer in every case
  3. It must be able to demonstrate compliance with data protection rules Correct answer.
  4. It must store all data on paper

Explanation

Accountability requires the organisation to take responsibility for compliance and to be able to demonstrate it, for example through policies, records and assessments. It does not mandate a DPO in all cases, nor does it require paper storage or consent for everything.

Question 8Privacy and Data Protection Fundamentals

Which of the following best defines personal data?

  1. Any information that is encrypted
  2. Any information owned by a company
  3. Any information relating to an identified or identifiable natural person Correct answer.
  4. Any information stored in a database

Explanation

Personal data is any information relating to an identified or identifiable natural person. The format of storage does not matter, and encryption is a safeguard rather than a definitional element.

Question 9Privacy and Data Protection Fundamentals

An organisation transfers personal data to a processor in another country without an adequacy decision or other transfer safeguard. What is the main compliance problem?

  1. The processor will automatically become a controller
  2. The transfer lacks a valid legal mechanism for international data transfer Correct answer.
  3. The data must be deleted within one hour
  4. The data subject loses all rights permanently

Explanation

Cross-border transfers outside the protected area require a transfer mechanism such as an adequacy decision, standard contractual clauses or another approved safeguard. Without one, the transfer is unlawful even if the processor is contractually bound. Roles and data subject rights are not automatically altered or lost.

Question 10Privacy and Data Protection Fundamentals

A marketing team wants to send newsletters to existing customers using their email addresses. Which consideration is most relevant to choosing a lawful basis?

  1. Email addresses are never personal data
  2. The organisation must obtain approval from each recipient's employer
  3. The organisation only needs to check whether the email server is secure
  4. The organisation must identify a lawful basis such as consent or legitimate interests and respect applicable e-marketing rules Correct answer.

Explanation

Email addresses are personal data, so a lawful basis is needed, and e-marketing rules may add requirements such as consent or an existing-customer exemption. Server security is a safeguard, not a substitute for a lawful basis.

Question 11Privacy and Data Protection Fundamentals

A data subject asks a company to delete personal data that is no longer needed for its original purpose. Which response is most consistent with the right to erasure?

  1. The company should assess whether an erasure ground applies and whether a legal retention obligation overrides it Correct answer.
  2. The company must always refuse because data must be kept for ten years
  3. The company should transfer the data to a processor instead
  4. The company should publish the data to demonstrate transparency

Explanation

Erasure is not absolute; the organisation must check whether a ground for erasure applies and whether an exception such as a legal retention obligation exists. Refusing automatically or repurposing the data is not a valid response.

Question 12Privacy and Data Protection Fundamentals

Which situation most likely requires a data protection officer to be appointed?

  1. A public authority carrying out large-scale systematic monitoring of individuals Correct answer.
  2. A sports club that stores a paper membership list
  3. A small bakery that only processes employee payroll data
  4. A sole trader with no employees and no customer database

Explanation

A DPO is required where processing is carried out by a public authority, involves large-scale systematic monitoring, or involves large-scale special category data. Ordinary small-scale processing such as payroll or a paper list does not automatically trigger the requirement.

Question 13Privacy and Data Protection Fundamentals

What is the main difference between pseudonymisation and anonymisation?

  1. Anonymisation is always reversible
  2. Pseudonymisation applies only to health data
  3. Pseudonymisation removes all legal obligations
  4. Pseudonymised data can still be linked to a person with additional information, while anonymised data cannot Correct answer.

Explanation

Pseudonymisation replaces identifiers so data cannot be attributed without additional information kept separately; the data remains personal data. Anonymisation means the data can no longer be linked to an identifiable person, so data protection law no longer applies.

Question 14Privacy and Data Protection Fundamentals

A company collects more customer details than it needs for a loyalty programme. Which principle is most directly engaged?

  1. Data minimisation Correct answer.
  2. Integrity and confidentiality
  3. Accuracy
  4. Storage limitation

Explanation

Data minimisation requires that data be adequate, relevant and limited to what is necessary for the purpose. Collecting excessive details breaches this principle. Accuracy concerns correctness, storage limitation concerns retention periods, and integrity concerns security.

Question 15Privacy and Data Protection Fundamentals

Which of the following is an example of a technical measure supporting integrity and confidentiality?

  1. Encrypting personal data at rest and in transit Correct answer.
  2. Recording the purpose of processing in a register
  3. Appointing a works council representative
  4. Publishing the privacy notice on the website

Explanation

Integrity and confidentiality require appropriate security measures such as encryption, access control and resilience. Publishing a notice and recording purposes support transparency and accountability but do not themselves protect data.

Question 16Privacy and Data Protection Fundamentals

A processor receives a request from a data subject asking for access to their data. What should the processor generally do?

  1. Answer the request directly without informing the controller
  2. Forward the request to the controller and assist as agreed in the contract Correct answer.
  3. Delete all data immediately
  4. Ignore the request because only controllers have obligations

Explanation

Data subject requests are addressed to the controller, which bears the legal responsibility for responding. A processor must assist the controller and pass the request on without undue delay, as set out in the processing contract.

Question 17Privacy and Data Protection Fundamentals

Which statement about a privacy notice is most accurate?

  1. It is only required for special category data
  2. It replaces the need for a lawful basis
  3. It must be written in a language the data subject understands and include key information such as purposes and rights Correct answer.
  4. It may omit the identity of the controller if the company is well known

Explanation

Privacy notices must provide concise, transparent, intelligible and easily accessible information, including the controller's identity, purposes, lawful basis, recipients and rights. Omitting mandatory information or limiting notices to sensitive data is non-compliant, and a notice never substitutes for a lawful basis.

Question 18Privacy and Data Protection Fundamentals

A hospital processes patient health records. Which statement about the applicable lawful basis is correct?

  1. Health data is not personal data
  2. Health data can be processed without any legal condition
  3. Only the patient's consent is ever acceptable for health data
  4. Processing health data requires a lawful basis plus a specific condition for special category data Correct answer.

Explanation

Processing special category data requires both an Article 6 lawful basis and an Article 9 condition, such as provision of health care or explicit consent. Health data is clearly personal data, and explicit consent is not the only possible condition.

Question 19Privacy and Data Protection Fundamentals

Which action best demonstrates the principle of privacy by design?

  1. Transferring all data to a third party
  2. Building data protection safeguards into a system from the outset Correct answer.
  3. Collecting data first and deciding its purpose later
  4. Adding privacy settings only after a product has launched

Explanation

Privacy by design means embedding data protection into the design of systems and processes from the start, rather than retrofitting safeguards. It also aligns with data protection by default, which limits collection to what is necessary.

Question 20Privacy and Data Protection Fundamentals

A company plans a new system that will profile employees' productivity. Which step is most appropriate before deployment?

  1. Wait for a complaint before assessing risks
  2. Conduct a DPIA because the processing may pose high risks to individuals Correct answer.
  3. Publish the results of the profiling to the whole company
  4. Rely on the employees' implied consent from their employment contracts

Explanation

Systematic monitoring and profiling of employees can create high risks, so a DPIA should be carried out before processing begins. Implied consent is generally not valid in an employment relationship due to the power imbalance, and waiting for a complaint is reactive.

Question 21Privacy and Data Protection Fundamentals

Which situation best illustrates the storage limitation principle?

  1. Backing up data to multiple locations without a retention policy
  2. Encrypting data but never reviewing whether it is still needed
  3. Defining retention periods and deleting data once they expire Correct answer.
  4. Keeping customer records indefinitely because storage is cheap

Explanation

Storage limitation requires that data be kept no longer than necessary, which is achieved through defined retention periods and deletion. Cheap storage, encryption or multiple backups do not justify indefinite retention.

Question 22Privacy and Data Protection Fundamentals

An organisation receives a request to rectify inaccurate data. The data is used by a processor and has already been disclosed to a third party. What is the most complete response?

  1. Correct the data only in the main system and ignore recipients
  2. Delete the entire database to be safe
  3. Correct the data and take reasonable steps to inform recipients of the rectification Correct answer.
  4. Refuse because the data was already shared

Explanation

Rectification requires correcting inaccurate data and, where feasible, informing recipients to whom the data was disclosed so they can update their records. Ignoring recipients or deleting unrelated data is disproportionate.

Question 23Privacy and Data Protection Fundamentals

A controller uses a processor that subcontracts part of the processing to another company without authorisation. What is the key compliance issue?

  1. The processor breached the requirement to obtain prior authorisation for sub-processors Correct answer.
  2. The controller automatically becomes a processor
  3. Sub-processors may never be used
  4. The sub-processor becomes the only responsible party

Explanation

A processor may engage a sub-processor only with the controller's prior specific or general written authorisation and must impose equivalent obligations by contract. Unauthorised subcontracting is a breach, but it does not shift responsibility away from the controller.

Question 24Privacy and Data Protection Fundamentals

Which scenario most clearly indicates that a DPIA must be carried out?

  1. An office reordering printer paper
  2. A newsagent storing a list of newspaper delivery addresses
  3. A café recording daily milk orders
  4. A bank introducing large-scale systematic monitoring of customer transactions for profiling Correct answer.

Explanation

A DPIA is required where processing is likely to result in a high risk, and large-scale systematic monitoring or profiling is a recognised indicator. Routine low-risk administrative processing does not trigger the requirement.

Question 25Privacy and Data Protection Fundamentals

A data subject objects to processing based on legitimate interests. The controller cannot show compelling legitimate grounds. What is the correct outcome?

  1. The controller must transfer the data to a processor
  2. The controller must stop the processing for that purpose Correct answer.
  3. The controller may continue because legitimate interests always prevail
  4. The controller may charge the data subject a fee to continue

Explanation

Where processing is based on legitimate interests and the data subject objects, the controller must stop unless it demonstrates compelling legitimate grounds that override the individual's interests. Legitimate interests do not automatically prevail, and no fee can be charged to preserve the processing.

Question 26Privacy and Data Protection Fundamentals

Under the GDPR, which role determines the purposes and means of processing personal data?

  1. The supervisory authority
  2. The controller Correct answer.
  3. The processor
  4. The data subject

Explanation

The controller is the entity that alone or jointly with others determines the purposes and means of the processing of personal data. The processor only acts on the controller's documented instructions. Supervisory authorities oversee compliance, and data subjects are the individuals whose data is processed.

Question 27Privacy and Data Protection Fundamentals

Which concept describes processing that cannot reasonably be linked back to an identified or identifiable person because the identifying information has been irreversibly removed?

  1. Encryption at rest
  2. Pseudonymisation
  3. Anonymisation Correct answer.
  4. Tokenisation

Explanation

Anonymisation removes identifying elements so that re-identification is no longer reasonably possible, taking account of all means reasonably likely to be used. Truly anonymous information falls outside the scope of data protection law. Pseudonymisation and tokenisation keep a link (such as a key or mapping table) that can restore identification.

Question 28Privacy and Data Protection Fundamentals

Which principle requires that personal data be collected for specified, explicit and legitimate purposes and not further processed in an incompatible manner?

  1. Accuracy
  2. Storage limitation
  3. Purpose limitation Correct answer.
  4. Data minimisation

Explanation

Purpose limitation requires controllers to define specified, explicit and legitimate purposes at collection and to avoid incompatible further processing. Data minimisation concerns how much data is collected, storage limitation concerns how long it is kept, and accuracy concerns correctness of the data.

Question 29Privacy and Data Protection Fundamentals

Which concept gives individuals the right to receive their personal data in a structured, commonly used and machine-readable format and to transmit it to another controller?

  1. Right to erasure
  2. Right to data portability Correct answer.
  3. Right to restriction of processing
  4. Right of access

Explanation

Data portability allows a data subject to receive data they provided in a structured, commonly used, machine-readable format and to transmit it to another controller where processing is based on consent or contract and carried out by automated means. Erasure, restriction and access are distinct rights with different conditions.

Question 30Privacy and Data Protection Fundamentals

What does the GDPR require when personal data is transferred to a country outside the EEA that has no adequacy decision?

  1. Nothing extra, because the GDPR stops applying once data leaves the EEA
  2. A notification to the data subject after the transfer has occurred
  3. An appropriate safeguard such as standard contractual clauses or binding corporate rules Correct answer.
  4. Only the consent of the company's management

Explanation

Transfers outside the EEA require a lawful transfer mechanism when no adequacy decision exists, such as standard contractual clauses, binding corporate rules or an Article 49 derogation. The GDPR continues to apply to the processing, and the data subject must be informed in advance through the privacy notice.

Question 31Privacy and Data Protection Fundamentals

Which statement correctly describes the relationship between a controller and a processor under the GDPR?

  1. The processor is fully liable for all controller decisions about lawful basis
  2. The relationship must be governed by a contract or other legal act setting out the subject matter, duration, nature and purpose of processing Correct answer.
  3. The controller must obtain prior authorisation from the processor before any processing
  4. The processor may set its own purposes provided it informs the controller

Explanation

Article 28 requires a binding contract or other legal act between controller and processor that specifies the subject matter, duration, nature and purpose of processing, the type of data and categories of data subjects, and the obligations of the processor. The processor acts only on documented instructions and cannot set its own purposes.

Question 32Privacy and Data Protection Fundamentals

What is the primary role of a supervisory authority such as a national data protection authority?

  1. To certify that all processing operations are lawful before they begin
  2. To monitor and enforce compliance with data protection law within its jurisdiction Correct answer.
  3. To represent data subjects in civil litigation against controllers
  4. To process data subject requests on behalf of controllers

Explanation

Supervisory authorities are independent public bodies that monitor and enforce the application of data protection law, handle complaints, conduct investigations and may impose administrative fines. They do not process requests for controllers, pre-approve every processing operation, or act as litigation representatives for individuals.

Question 33Privacy and Data Protection Fundamentals

A retailer collects a customer's phone number for delivery updates and later uses the same number for unrelated third-party advertising without informing the customer. Which principle is most directly breached?

  1. Integrity and confidentiality
  2. Purpose limitation Correct answer.
  3. Accuracy
  4. Data portability

Explanation

Using data for an unrelated purpose that was not compatible with the original collection purpose breaches purpose limitation. The customer provided the number for delivery updates, and repurposing it for third-party advertising goes beyond that specified purpose. Accuracy, security and portability address different obligations.

Question 34Privacy and Data Protection Fundamentals

A company wants to rely on legitimate interests for a new analytics feature. What must it do first to use this basis lawfully?

  1. Obtain written consent from every affected individual
  2. Carry out and document a balancing test weighing its interests against the rights and freedoms of individuals Correct answer.
  3. Publish the names of all analytics staff in its privacy notice
  4. Register the processing with the supervisory authority before launch

Explanation

Legitimate interests require a three-part assessment: a legitimate interest, necessity of the processing, and a balancing exercise showing that individuals' rights and freedoms do not override that interest. The assessment must be documented and reflected in the privacy notice. Consent is an alternative basis, not a prerequisite, and registration or staff disclosure is not required.

Question 35Privacy and Data Protection Fundamentals

An online store receives a request from a customer to delete their account data. The store still has a legal obligation to retain invoices for tax purposes. What is the most appropriate response?

  1. Erase the data that is no longer needed and retain only the invoice data required by law, informing the customer Correct answer.
  2. Refuse the entire request because some data must be retained
  3. Delete all data immediately, including the invoices, to comply with the request
  4. Transfer the entire account record to the tax authority and close the request

Explanation

The right to erasure is not absolute; it does not apply where processing is necessary for compliance with a legal obligation. The controller should erase what can be erased and retain only the data needed for the statutory retention duty, explaining the partial retention to the individual.

Question 36Privacy and Data Protection Fundamentals

A controller discovers that a processor has suffered a personal data breach affecting customers. Who must notify the supervisory authority, and when?

  1. The controller, without undue delay and where feasible within 72 hours of becoming aware Correct answer.
  2. The processor, within 24 hours of discovering the breach
  3. The data subjects, immediately and before any internal assessment
  4. The supervisory authority itself, once it learns about the breach from the media

Explanation

The controller is responsible for notifying the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of a breach unless it is unlikely to result in a risk. The processor must notify the controller without undue delay, but the controller owns the regulatory notification.

Question 37Privacy and Data Protection Fundamentals

A payroll provider processes employee data on behalf of several client companies. Which obligation applies to the payroll provider as a processor?

  1. It must assist the controller in responding to data subject requests and in ensuring security Correct answer.
  2. It must publish its own privacy notice as controller for the employees
  3. It may keep copies of employee data for its own marketing after the contract ends
  4. It must decide the lawful basis for each client's payroll processing

Explanation

Processors must assist controllers in meeting obligations such as responding to data subject requests, ensuring security, and handling breaches. They act on documented instructions and must not use the data for their own purposes. Choosing the lawful basis and issuing a controller notice remain the client's responsibility.

Question 38Privacy and Data Protection Fundamentals

A bank wants to verify customers' identities using fingerprint scanning at branch entrances. Which statement about this processing is most accurate?

  1. Fingerprint data is ordinary personal data, so no additional condition is needed
  2. Biometric data can be processed freely if the customer signs a general service agreement
  3. Biometric data used for unique identification is a special category and requires an additional legal condition Correct answer.
  4. Fingerprint scanning is prohibited outright under the GDPR

Explanation

Biometric data processed for the purpose of uniquely identifying a person is a special category of personal data. It is prohibited unless a specific condition in Article 9 applies, such as explicit consent or a substantial public interest basis, and the general lawful basis and principles must also be satisfied.

Question 39Privacy and Data Protection Fundamentals

A company wants to include customer testimonials with full names and photographs on its website. Which approach best reflects valid consent?

  1. Rely on the general terms and conditions accepted at sign-up
  2. Collect consent once and treat it as valid indefinitely for all future marketing
  3. Obtain a separate, affirmative indication specifically covering publication of the name and photo, with an easy way to withdraw Correct answer.
  4. Assume consent because the customer praised the company in an email

Explanation

Consent must be freely given, specific, informed and unambiguous, expressed by a clear affirmative action, and as easy to withdraw as to give. Bundling it into general terms or inferring it from praise does not meet these standards, and consent must be refreshed when circumstances change.

Question 40Privacy and Data Protection Fundamentals

During a job application process, a recruiter wants to keep unsuccessful candidates' CVs on file for two years in case future roles arise. What is the most appropriate action?

  1. Delete the CVs immediately in all cases, because retention is never allowed
  2. Keep the CVs without informing candidates, since recruitment is a legitimate interest
  3. Keep the CVs indefinitely to build a talent pool
  4. Inform candidates and offer a clear opportunity to consent or object to retention for future roles, with a defined retention period Correct answer.

Explanation

Retaining CVs beyond the recruitment process requires a clear purpose, transparency and a defined retention period. The controller should inform candidates and provide a genuine choice about inclusion in a talent pool. Indefinite retention or silent retention lacks a lawful, transparent basis.

Question 41Privacy and Data Protection Fundamentals

A controller designs a new mobile app and wants to embed data protection from the outset. Which action best reflects data protection by design?

  1. Configuring default settings that collect the minimum data and enable privacy-protective options automatically Correct answer.
  2. Collecting all available device identifiers in case they become useful later
  3. Assigning privacy responsibilities to the marketing team after launch
  4. Adding a privacy notice to the app store listing after development is complete

Explanation

Data protection by design and by default requires technical and organisational measures to be built in during design, including privacy-protective default settings and minimisation. Adding documentation after development, collecting unnecessary identifiers, or assigning responsibility after launch are reactive and do not meet the requirement.

Question 42Privacy and Data Protection Fundamentals

An organisation's privacy notice lists a broad range of possible recipients, including 'partners and affiliates', without naming categories meaningfully. Which requirement is most directly at risk?

  1. The requirement to conduct a DPIA for every processing activity
  2. The requirement to appoint a representative in the EU
  3. The requirement that information provided to data subjects be concise, transparent, intelligible and specific Correct answer.
  4. The requirement to keep processing records for three years

Explanation

Privacy information must be concise, transparent, intelligible and easily accessible, using clear and plain language, and must meaningfully describe recipients or categories of recipients. Vague references to 'partners and affiliates' undermine transparency. The other options describe obligations that do not apply as stated.

Question 43Privacy and Data Protection Fundamentals

A controller receives an access request but suspects the requester is not the data subject. What is the most appropriate step?

  1. Release the data immediately to avoid missing the deadline
  2. Ask the individual to submit the request through a public social media account
  3. Request additional information to confirm identity before disclosing the data Correct answer.
  4. Refuse all access requests from that individual permanently

Explanation

Where a controller has reasonable doubts about identity, it may request additional information necessary to confirm it before disclosing personal data. The response deadline runs from receipt, but identity verification is a legitimate step. Refusing permanently or disclosing without verification would be inappropriate.

Question 44Privacy and Data Protection Fundamentals

A controller shares personal data with a joint controller for a co-marketing campaign. Which statement best describes their obligations?

  1. Joint controllership automatically converts the arrangement into a processor relationship
  2. They must determine their respective responsibilities for compliance by transparent arrangement, and data subjects can exercise rights against either Correct answer.
  3. Only the larger organisation has any responsibility for the processing
  4. Joint controllers are exempt from providing privacy information

Explanation

Joint controllers must transparently determine their respective responsibilities for compliance, in particular for exercising data subject rights and providing information, though data subjects may exercise their rights against either party. The essence of the arrangement must be made available to individuals.

Question 45Privacy and Data Protection Fundamentals

A company argues that because it has pseudonymised its customer database, the data is outside the scope of the GDPR. How should this claim be assessed?

  1. Correct, because pseudonymised data can never be re-identified
  2. Correct, provided the key is stored in the same department
  3. Incorrect, because pseudonymised data remains personal data when it can be attributed to a person using additional information Correct answer.
  4. Incorrect only if the data includes special categories

Explanation

Pseudonymised data that can be attributed to a natural person by the use of additional information remains personal data and is fully within scope. The controller must protect the additional information and apply appropriate safeguards. Anonymisation, not pseudonymisation, removes data from scope.

Question 46Privacy and Data Protection Fundamentals

A controller relies on consent for processing, but a data subject later withdraws it. What is the correct legal position?

  1. Withdrawal has no effect until the end of the contract year
  2. The controller may continue processing if it prefers consent to another basis
  3. Withdrawal stops the processing from that point, without affecting the lawfulness of prior processing, and the controller must act promptly Correct answer.
  4. Withdrawal makes the processing unlawful from the original date of consent

Explanation

Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal, but the controller must stop processing based on consent once it is withdrawn. It must be as easy to withdraw as to give consent. Continuing to rely on the withdrawn consent is unlawful.

Question 47Privacy and Data Protection Fundamentals

A controller plans to use automated decision-making that produces legal effects on individuals. Which statement best reflects the GDPR position?

  1. Solely automated decisions with legal or similarly significant effects are restricted unless based on explicit consent, contract necessity or law, with safeguards such as human intervention Correct answer.
  2. Automated decisions are prohibited in all circumstances
  3. Such decisions are always permitted if the controller has a legitimate interest, with no further conditions
  4. Individuals have no right to be informed about automated decision-making

Explanation

Article 22 restricts solely automated decisions, including profiling, that produce legal effects or similarly significantly affect individuals. Such decisions are allowed only where necessary for a contract, authorised by law, or based on explicit consent, and suitable safeguards such as human intervention and the ability to contest must be in place.

Question 48Privacy and Data Protection Fundamentals

An organisation processes large-scale special category data as a core activity. Which conclusion about its DPO obligation is most accurate?

  1. A DPO is required only if the supervisory authority requests one after a complaint
  2. A DPO is required only if the organisation has more than 250 employees
  3. A DPO is required because large-scale processing of special category data is a core activity Correct answer.
  4. A DPO is never required for private companies

Explanation

A DPO must be designated where processing is carried out by a public authority, where core activities require regular and systematic monitoring of individuals on a large scale, or where core activities consist of large-scale processing of special category data or criminal data. Employee numbers alone do not determine the obligation.

Question 49Privacy and Data Protection Fundamentals

Under the GDPR, which principle requires that personal data be collected for specified, explicit and legitimate purposes and not further processed in a way incompatible with those purposes?

  1. Purpose limitation Correct answer.
  2. Storage limitation
  3. Integrity and confidentiality
  4. Data minimisation

Explanation

Purpose limitation means personal data may only be gathered for specified, explicit and legitimate purposes and must not be reused for incompatible purposes. The other principles address how long data is kept, how much is collected, and how it is secured.

Question 50Privacy and Data Protection Fundamentals

A marketing team wants to send promotional emails to a list of addresses that were originally collected during an online checkout. Which action is most consistent with the GDPR principle of lawfulness, fairness and transparency?

  1. Check the applicable e-marketing rules, identify a valid legal basis, and give a clear opt-out Correct answer.
  2. Assume that existing customers can never receive marketing emails
  3. Rely on the original checkout collection without informing customers
  4. Send the emails first and remove recipients only after they complain

Explanation

Processing must rest on a lawful basis and be transparent to data subjects. The team should confirm which legal basis applies under the GDPR and relevant e-marketing rules, then provide clear information and an easy opt-out.