I85PREP
⌘ K
UKOMNAS PDPA study materials
UKOMNAS PDPA study resources

UKOMNAS PDPA practice questions

One question at a time. Build your UKOMNAS PDPA understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Legal and Regulatory Framework for Personal Data Protection

Under Indonesia's Law No. 27 of 2022 on Personal Data Protection (UU PDP), which of the following best describes the scope of data subjects whose personal data is protected when processed by a controller established in Indonesia?

  1. Any individual whose personal data is processed in Indonesia or by a controller subject to Indonesian law, regardless of nationality. Correct answer.
  2. Only individuals who have registered a formal complaint with the supervisory authority.
  3. Only individuals who have provided written consent to a specific controller.
  4. Only Indonesian citizens residing within Indonesian territory.

Explanation

UU PDP protects personal data of individuals (orang) and applies territorially and extraterritorially to controllers/processors subject to Indonesian law, so nationality alone is not the dividing criterion. Consent is one lawful basis, not a precondition for the law's protection to attach.

Question 2Legal and Regulatory Framework for Personal Data Protection

In UU PDP terminology, which party determines the purpose and control of personal data processing?

  1. Prosesor Data Pribadi (Personal Data Processor)
  2. Subjek Data Pribadi (Data Subject)
  3. Pengendali Data Pribadi (Personal Data Controller) Correct answer.
  4. Penerima Data Pribadi (Data Recipient)

Explanation

The controller is defined as the party that determines the purpose and controls the processing of personal data. The processor acts on behalf of the controller, while the data subject is the individual to whom the data relates.

Question 3Legal and Regulatory Framework for Personal Data Protection

Which of the following is expressly recognized under UU PDP as a lawful basis for processing personal data without relying on consent?

  1. Publication of the data in a public directory
  2. Assumption of consent based on the data subject's silence
  3. Approval by a foreign data protection authority
  4. Fulfilment of a contract to which the data subject is a party Correct answer.

Explanation

UU PDP lists several lawful bases besides explicit consent, including fulfilment of a contract, legal obligation, vital interests, and legitimate interests. Silence or inaction does not constitute valid consent, and foreign authority approval is not a basis under the law.

Question 4Legal and Regulatory Framework for Personal Data Protection

A company wants to process an employee's personal data to comply with a tax reporting obligation. Which lawful basis under UU PDP most appropriately applies?

  1. Fulfilment of a legal obligation of the controller Correct answer.
  2. Explicit consent from the employee
  3. Vital interest of the company's shareholders
  4. Legitimate interest of a third-party auditor

Explanation

When processing is necessary to comply with a statutory obligation, UU PDP recognizes fulfilment of a legal obligation as the appropriate basis rather than consent. Seeking consent for a mandatory legal duty would be misleading because the data subject cannot meaningfully refuse.

Question 5Legal and Regulatory Framework for Personal Data Protection

Under UU PDP, when must a controller provide information to a data subject about the processing of their personal data?

  1. Only after the data subject submits a written request
  2. Only when data is transferred outside Indonesia
  3. Only when a data breach has occurred
  4. At or before the time personal data is obtained, in a concise and clear manner Correct answer.

Explanation

UU PDP requires controllers to inform data subjects of processing purposes, legal basis, and related details at or before the time the data is collected. The information must be provided in an accessible and understandable form.

Question 6Legal and Regulatory Framework for Personal Data Protection

Which right under UU PDP allows a data subject to request that a controller stop processing their personal data?

  1. Right to data portability
  2. Right to restrict or object to processing Correct answer.
  3. Right to access
  4. Right to erasure

Explanation

UU PDP grants data subjects the right to restrict or object to processing of their personal data, including requesting that processing be suspended or stopped. Erasure concerns deletion, access concerns obtaining copies, and portability concerns transferring data.

Question 7Legal and Regulatory Framework for Personal Data Protection

A data subject submits a request to obtain a copy of their personal data held by a controller. Which right under UU PDP is being exercised?

  1. Right to object to automated decision-making
  2. Right to compensation
  3. Right to access and obtain a copy of personal data Correct answer.
  4. Right to withdraw consent

Explanation

The right of access entitles a data subject to obtain information and a copy of their personal data undergoing processing. The other listed rights address different concerns such as automated decisions, consent withdrawal, and damages.

Question 8Legal and Regulatory Framework for Personal Data Protection

Under UU PDP, which of the following best describes the obligation on a controller when a personal data breach occurs?

  1. Notify affected data subjects and the supervisory authority within the time period prescribed by the law Correct answer.
  2. Notify only the controller's internal auditors
  3. Notify only after a court order is issued
  4. Notify only if the breach results in financial loss exceeding a fixed statutory threshold

Explanation

UU PDP requires controllers to notify affected data subjects and the supervisory authority of a personal data breach within the prescribed period, typically described as no later than three by twenty-four hours. Notification is a statutory duty, not dependent on a court order.

Question 9Legal and Regulatory Framework for Personal Data Protection

What is the general time frame under UU PDP for a controller to notify data subjects and the supervisory authority of a personal data breach?

  1. No later than 30 calendar days
  2. No later than 14 working days
  3. No later than 6 months
  4. No later than 3 by 24 hours Correct answer.

Explanation

UU PDP requires written notification of a personal data breach to data subjects and the supervisory authority no later than 3 by 24 hours (three days and twenty-four hours) after the controller becomes aware. The notification must include specified details about the breach.

Question 10Legal and Regulatory Framework for Personal Data Protection

A controller wishes to transfer personal data to a recipient outside Indonesia. Which of the following best reflects the UU PDP approach to cross-border transfers?

  1. Transfers are freely permitted without any conditions
  2. Transfers are permitted only after approval by the recipient country's government
  3. Transfers are permitted subject to safeguards such as adequacy, appropriate safeguards, or consent where required Correct answer.
  4. Transfers are prohibited unless the data subject signs a waiver of all rights

Explanation

UU PDP allows cross-border transfers but attaches conditions, including ensuring the destination country offers an equal or higher level of protection, or relying on adequate safeguards or consent in specified circumstances. Unconditional free transfer is not permitted.

Question 11Legal and Regulatory Framework for Personal Data Protection

Under UU PDP, which party is responsible for appointing a Data Protection Officer (DPO) where processing requires one?

  1. The data subject
  2. The Personal Data Controller Correct answer.
  3. The supervisory authority
  4. The data recipient

Explanation

UU PDP places the obligation to appoint a DPO on the controller where processing meets specified criteria, such as large-scale or sensitive processing. The DPO then supports compliance and acts as a contact point.

Question 12Legal and Regulatory Framework for Personal Data Protection

Which of the following is an example of sensitive personal data under UU PDP?

  1. Health and medical records Correct answer.
  2. Public social media username
  3. Company registration number
  4. Office phone number

Explanation

UU PDP treats certain categories as specific/sensitive personal data, including health data, biometric data, genetic data, and data concerning children. Ordinary business identifiers and contact details are not in that category.

Question 13Legal and Regulatory Framework for Personal Data Protection

Processing of sensitive personal data under UU PDP generally requires which additional element beyond ordinary processing?

  1. Registration with a foreign regulator
  2. Explicit consent or another specific legal basis specified for sensitive data Correct answer.
  3. A minimum retention period of ten years
  4. Notification to the data subject's employer

Explanation

UU PDP imposes stricter conditions for specific/sensitive personal data, generally requiring explicit consent or another narrowly defined legal basis. Ordinary lawful bases are not automatically sufficient for sensitive categories.

Question 14Legal and Regulatory Framework for Personal Data Protection

Which principle under UU PDP requires that personal data be collected for specified, explicit, and legitimate purposes and not further processed in a manner incompatible with those purposes?

  1. Purpose limitation Correct answer.
  2. Accuracy
  3. Storage limitation
  4. Integrity and confidentiality

Explanation

Purpose limitation restricts processing to the purposes specified at collection unless a compatible basis exists. Storage limitation concerns retention periods, accuracy concerns correctness, and integrity/confidentiality concerns security.

Question 15Legal and Regulatory Framework for Personal Data Protection

A controller retains customer data indefinitely because storage is cheap. Which UU PDP principle is most directly engaged?

  1. Data portability
  2. Purpose limitation
  3. Transparency
  4. Storage limitation Correct answer.

Explanation

Storage limitation requires that personal data be kept only as long as necessary for the processing purpose. Indefinite retention without justification conflicts with this principle, and controllers should define and apply retention periods.

Question 16Legal and Regulatory Framework for Personal Data Protection

Under UU PDP, processing personal data of a child requires which approach?

  1. Processing based on parental or guardian consent and protection of the child's best interests Correct answer.
  2. Processing only after the child reaches the age of majority
  3. No special treatment because children's data is ordinary data
  4. Processing only with approval from the supervisory authority

Explanation

UU PDP treats children's personal data as requiring specific protection, generally requiring consent from a parent or guardian and consideration of the child's best interests. Children's data is not treated as ordinary data without safeguards.

Question 17Legal and Regulatory Framework for Personal Data Protection

Which of the following best describes the role of the supervisory authority under UU PDP?

  1. It acts as the data processor for all public bodies
  2. It processes personal data on behalf of controllers
  3. It oversees compliance, receives complaints, and may impose administrative sanctions Correct answer.
  4. It issues consent forms to data subjects

Explanation

The supervisory authority established under UU PDP monitors compliance, handles complaints, and can impose administrative sanctions. It does not act as a processor for controllers or issue consent forms.

Question 18Legal and Regulatory Framework for Personal Data Protection

Which type of sanction may be imposed under UU PDP for violations of personal data protection obligations?

  1. Only criminal imprisonment
  2. Administrative sanctions such as fines, suspension of processing, and data deletion orders Correct answer.
  3. Only warnings without any financial consequence
  4. Only civil damages awarded to the controller

Explanation

UU PDP provides for administrative sanctions, including administrative fines, suspension of processing activities, and orders to delete or destroy personal data. Criminal provisions also exist for certain serious offences.

Question 19Legal and Regulatory Framework for Personal Data Protection

A data subject exercises the right to erasure. Which UU PDP obligation does the controller primarily face?

  1. Publishing the deletion in a national newspaper
  2. Increasing the retention period to verify the request
  3. Transferring the data to a competitor
  4. Deleting or destroying the personal data, subject to lawful retention exceptions Correct answer.

Explanation

The right to erasure requires the controller to delete or destroy personal data when the legal basis for retention no longer applies, subject to exceptions such as legal retention duties. The controller must act on the request rather than extend retention.

Question 20Legal and Regulatory Framework for Personal Data Protection

Under UU PDP, when a data subject withdraws consent for processing, what is the controller's general obligation?

  1. Charge the data subject a fee for withdrawal
  2. Stop processing the data unless another lawful basis applies Correct answer.
  3. Transfer the data to the supervisory authority
  4. Continue processing because consent cannot be withdrawn

Explanation

Consent under UU PDP may be withdrawn, and once withdrawn the controller must cease processing unless another lawful basis supports continued processing. Withdrawal must be as easy as giving consent.

Question 21Legal and Regulatory Framework for Personal Data Protection

Which of the following best characterizes the requirement for consent to be valid under UU PDP?

  1. Consent may be bundled with unrelated terms and conditions
  2. Consent may be assumed from the data subject's failure to opt out
  3. Consent must be explicit, informed, and freely given based on clear information Correct answer.
  4. Consent may be inferred from continued use of a website

Explanation

Valid consent under UU PDP must be explicit, informed, and freely given, based on clear information about the processing. Pre-ticked boxes, bundled terms, and opt-out assumptions do not meet this standard.

Question 22Legal and Regulatory Framework for Personal Data Protection

A processor engaged by a controller must act in what manner under UU PDP?

  1. Only on the instruction of the data subject
  2. According to the controller's instructions and subject to contractual obligations Correct answer.
  3. Only after obtaining a court order
  4. At its own discretion, independent of the controller

Explanation

A processor processes personal data on behalf of the controller and must follow the controller's instructions, typically formalized in a written agreement. It cannot process at its own discretion beyond those instructions.

Question 23Legal and Regulatory Framework for Personal Data Protection

Which of the following obligations is most closely associated with the principle of integrity and confidentiality under UU PDP?

  1. Implementing technical and organizational security measures to protect personal data Correct answer.
  2. Deleting data when no longer needed
  3. Informing data subjects of processing activities
  4. Ensuring data is collected for specified purposes

Explanation

Integrity and confidentiality require controllers and processors to implement appropriate technical and organizational security measures against unauthorized access, loss, or alteration. The other options correspond to purpose limitation, storage limitation, and transparency.

Question 24Legal and Regulatory Framework for Personal Data Protection

A data subject objects to a decision made solely by automated processing that produces legal effects. Under UU PDP, what is the controller expected to do?

  1. Ignore the objection because automated decisions are always permitted
  2. Delete all data without review
  3. Refer the matter only to a foreign regulator
  4. Provide a mechanism for the data subject to object and obtain human intervention or explanation Correct answer.

Explanation

UU PDP gives data subjects the right to object to solely automated decision-making that has legal or significant effects and to request human intervention or an explanation. Controllers must provide such mechanisms rather than ignore the objection.

Question 25Legal and Regulatory Framework for Personal Data Protection

Which statement best reflects the relationship between UU PDP and existing sectoral regulations governing personal data?

  1. UU PDP replaces all sectoral regulations entirely
  2. UU PDP applies only to public bodies, leaving the private sector to sectoral rules
  3. UU PDP operates alongside sectoral regulations, and more specific sectoral rules may continue to apply where consistent Correct answer.
  4. UU PDP applies only to electronic data, leaving paper records unregulated

Explanation

UU PDP is a general framework that coexists with sectoral regulations, and specific rules may continue to apply where consistent with the law. It does not simply abolish sectoral regimes nor confine itself to public bodies or electronic data only.

Question 26Legal and Regulatory Framework for Personal Data Protection

Under UU PDP, which legal basis is generally relied upon to process personal data without the data subject's consent because a statute or regulation requires the controller to do so?

  1. Performance of a legal obligation of the controller Correct answer.
  2. Legitimate interest of the controller
  3. Vital interest of the data subject
  4. Explicit consent of the data subject

Explanation

UU PDP recognizes several lawful bases for processing, one of which is fulfilment of a legal obligation to which the controller is subject. When another statute or regulation mandates the processing, the controller may rely on that obligation rather than on consent. Consent becomes unnecessary in such a case because the law itself supplies the basis.

Question 27Legal and Regulatory Framework for Personal Data Protection

A company collects a customer's email address for an online order, then begins sending unrelated third-party marketing emails using that address without any new basis. Which UU PDP principle is most directly violated?

  1. Purpose limitation Correct answer.
  2. Data accuracy
  3. Right to access
  4. Integrity and confidentiality

Explanation

Purpose limitation requires that personal data be collected for specified, explicit, and legitimate purposes and not be further processed in a way incompatible with those purposes. Using an order email for unrelated third-party marketing exceeds the original purpose. A new lawful basis, such as fresh consent, would be needed before such reuse.

Question 28Legal and Regulatory Framework for Personal Data Protection

A controller wants to rely on consent as its lawful basis. Which characteristic must that consent display to be valid under UU PDP?

  1. It must be freely given, specific, and informed, expressed clearly Correct answer.
  2. It must be obtained in writing and notarized
  3. It must be implied from the data subject's continued use of a service
  4. It must be bundled with acceptance of the service's general terms

Explanation

Valid consent under UU PDP must be freely given, specific, and informed, and expressed through a clear affirmative action or statement. Bundled or implied acceptance does not meet this standard because it is not specific or unambiguous. Consent must also be revocable and documented by the controller.

Question 29Legal and Regulatory Framework for Personal Data Protection

A controller engages a processor to run its customer support system. Under UU PDP, how should the relationship and obligations be structured?

  1. Through a written agreement that binds the processor to act only on the controller's instructions Correct answer.
  2. By transferring all obligations to the processor so the controller has no remaining duty
  3. Through an informal arrangement because the processor assumes the controller's duties
  4. By relying on the processor's own privacy policy instead of a contract

Explanation

UU PDP requires the controller and processor to formalize their relationship in a written agreement that sets out the scope of processing and binds the processor to act only on the controller's documented instructions. The controller remains accountable to the data subject and must supervise the processor. The processor does not take over the controller's legal duties.

Question 30Legal and Regulatory Framework for Personal Data Protection

A controller relies on legitimate interest as its lawful basis for a profiling activity. A data subject objects, and the controller must now assess whether to continue. Which approach best reflects the balance UU PDP requires?

  1. Continue automatically because legitimate interest always prevails once invoked
  2. Stop only if the data subject pays an administrative fee
  3. Weigh the controller's interest against the data subject's rights and stop unless overriding grounds justify continuing Correct answer.
  4. Refer the decision entirely to the processor operating the profiling system

Explanation

Where processing rests on legitimate interest, the controller must conduct a balancing assessment that weighs its own interest against the rights and interests of the data subject. When the data subject objects, the controller must show compelling overriding grounds to continue; otherwise processing should cease. The processor cannot make this determination because accountability stays with the controller.

Question 31Data Protection Principles and Lawful Bases for Processing

Under the Personal Data Protection Act 2010, which of the following best describes the scope of the Act's application to data users?

  1. It applies to any individual who stores personal data on a personal computer at home
  2. It applies only to government departments and statutory bodies processing personal data
  3. It applies to all data users established in Malaysia and to those not established in Malaysia but using equipment in Malaysia for processing personal data Correct answer.
  4. It applies only to commercial organisations engaged in online trading activities

Explanation

The Act has extraterritorial reach: a data user not established in Malaysia is caught if it uses equipment located in Malaysia to process personal data, otherwise than in transit. This ensures foreign entities handling data through Malaysian infrastructure fall within the regime. Domestic data users of all kinds, not merely online traders or government bodies, are also covered.

Question 32Data Protection Principles and Lawful Bases for Processing

Which of the following is a recognised data protection principle under section 5 of the PDPA?

  1. The data user must disclose all personal data to third parties on request
  2. Personal data must be processed for a lawful purpose directly related to the data user's activity Correct answer.
  3. The data user must retain personal data indefinitely for audit purposes
  4. Personal data must always be stored outside Malaysia to ensure security

Explanation

The first principle requires that personal data be processed only for a lawful purpose directly related to the activity of the data user, and that processing be necessary and adequate for that purpose. It does not compel disclosure to third parties or indefinite retention. Storage location is not a principle requirement.

Question 33Data Protection Principles and Lawful Bases for Processing

A retailer collects a customer's phone number to send promotional SMS messages but never informs the customer of the purpose. Which principle is most directly engaged?

  1. The integrity principle
  2. The security principle
  3. The notice and choice principle Correct answer.
  4. The access principle

Explanation

The notice and choice principle requires the data user to inform the data subject of the purpose of collection and the source of the data, generally at or before collection. Failing to tell the customer why the number is collected breaches that obligation. Choice also matters where the data is intended for direct marketing.

Question 34Data Protection Principles and Lawful Bases for Processing

Which lawful basis most commonly supports processing personal data in a commercial transaction under the PDPA?

  1. A court order obtained after processing begins
  2. Approval by a foreign data protection authority
  3. The data user's general business discretion
  4. Consent of the data subject Correct answer.

Explanation

Consent is the principal lawful basis under the PDPA; data users generally must obtain the data subject's consent to process personal data. Consent must be a genuine indication of agreement. Other bases such as legal obligations or contractual necessity exist but consent remains the default starting point.

Question 35Data Protection Principles and Lawful Bases for Processing

What does the disclosure principle under the PDPA primarily restrict?

  1. The data user's ability to store data in electronic form
  2. The data user's ability to collect data from the data subject directly
  3. The data user's ability to keep personal data confidential
  4. The data user's ability to disclose personal data for a purpose other than the purpose for which it was collected Correct answer.

Explanation

The disclosure principle prohibits disclosing personal data for a purpose other than the purpose disclosed at collection, or a directly related purpose, unless the data subject consents. It regulates onward sharing rather than collection or storage format. Consent or a permitted exception is required for other disclosures.

Question 36Data Protection Principles and Lawful Bases for Processing

A data subject requests access to the personal data held about her. Under the access principle, the data user must generally comply unless an exception applies. Which of the following is a typical exception?

  1. The data subject is not a Malaysian citizen
  2. The data is held for the purpose of a criminal investigation or prosecution Correct answer.
  3. The data user prefers to respond orally rather than in writing
  4. The data subject has previously requested access once before

Explanation

The access principle is subject to exceptions, including data held for the prevention or detection of crime or for investigation and prosecution. In such cases access may be refused. The right is not extinguished merely because a prior request was made or the subject's nationality differs.

Question 37Data Protection Principles and Lawful Bases for Processing

Which principle requires a data user to take practical steps to protect personal data from loss, misuse, modification, or unauthorised access?

  1. The security principle Correct answer.
  2. The retention principle
  3. The notice principle
  4. The accuracy principle

Explanation

The security principle obliges the data user to take practical steps to protect personal data from loss, misuse, modification, unauthorised or accidental access, disclosure, alteration, or destruction. It covers both technical and organisational measures. The other principles address retention periods, accuracy, and notification respectively.

Question 38Data Protection Principles and Lawful Bases for Processing

What is the general rule on retention of personal data under the PDPA?

  1. Data may be kept indefinitely as long as it is encrypted
  2. Data must be deleted immediately after the first use
  3. Data must not be kept longer than is necessary for the fulfilment of the purpose for which it was collected Correct answer.
  4. Data must be kept for at least ten years after collection

Explanation

The retention principle requires that personal data not be kept longer than necessary for the purpose for which it was processed. Once the purpose is fulfilled, the data user should take reasonable steps to destroy or permanently delete the data. There is no fixed statutory minimum or maximum in years.

Question 39Data Protection Principles and Lawful Bases for Processing

A bank discovers that a customer's recorded address is out of date. Which principle requires the bank to take practical steps to correct it?

  1. The disclosure principle
  2. The accuracy principle Correct answer.
  3. The choice principle
  4. The retention principle

Explanation

The accuracy principle requires data users to take practical steps to ensure personal data is accurate, complete, not misleading, and kept up to date, having regard to the purpose for which it was collected. Correcting an outdated address gives effect to that duty. The other principles address sharing, choice, and retention.

Question 40Data Protection Principles and Lawful Bases for Processing

Under the PDPA, what must a data user generally do before collecting personal data from a data subject?

  1. Collect only biometric data
  2. Obtain approval from the Commissioner for each collection
  3. Publish the data subject's details in a public register
  4. Issue a written notice informing the data subject of the purpose of collection and other prescribed matters Correct answer.

Explanation

The notice and choice principle requires the data user to serve a written notice as soon as practicable, and generally at or before collection, setting out the purpose of collection, the source, the data subject's rights, and contact details. The notice may be in national and English languages. No prior Commissioner approval is required for ordinary collection.

Question 41Data Protection Principles and Lawful Bases for Processing

A data user intends to use personal data for a purpose that was not disclosed when the data was collected. What does the PDPA generally require?

  1. Fresh consent from the data subject for the new purpose, unless an exception applies Correct answer.
  2. Immediate destruction of the original data
  3. Nothing, provided the data user is a licensed entity
  4. Notification to the Commissioner within 24 hours

Explanation

Where data is to be used for a purpose not disclosed at collection and not directly related to it, the data user must obtain the data subject's consent for that new purpose. This flows from the notice and choice and disclosure principles. There is no general 24-hour notification rule to the Commissioner.

Question 42Data Protection Principles and Lawful Bases for Processing

Which of the following best describes the data subject's right of correction under the PDPA?

  1. The data subject may only request correction through a court order
  2. The data subject has no correction right; only access is provided
  3. The data subject may request correction of inaccurate personal data, and the data user must generally comply Correct answer.
  4. The data subject may demand deletion of all data without any conditions

Explanation

The access principle includes a right to request correction of personal data that is inaccurate, incomplete, misleading, or not up to date. On a compliant request, the data user must make the correction and notify relevant third parties where required. Deletion on demand without conditions is not the general rule.

Question 43Data Protection Principles and Lawful Bases for Processing

A company collects personal data and wishes to transfer it to a server located outside Malaysia. What does the PDPA require before such a transfer?

  1. The data user must obtain a licence from the foreign government
  2. The data user must ensure the transfer complies with conditions such as consent or comparable protection, unless an exception applies Correct answer.
  3. The data user must delete the data within seven days of transfer
  4. The transfer is always prohibited without exception

Explanation

The PDPA restricts transfers of personal data outside Malaysia unless conditions are met, such as the data subject's consent or the existence of a place with substantially similar law or adequate protection, subject to specified exceptions. The data user bears the burden of ensuring compliance. Transfers are not absolutely prohibited.

Question 44Data Protection Principles and Lawful Bases for Processing

Which of the following is an example of sensitive personal data under the PDPA?

  1. A person's favourite colour
  2. A person's office telephone number
  3. Information about a person's physical or mental health Correct answer.
  4. A company's registered address

Explanation

Sensitive personal data includes information about physical or mental health, political opinions, religious beliefs, commission of offences, and similar categories. Such data attracts stricter processing conditions. A business address or a preference is ordinary personal data, if personal data at all.

Question 45Data Protection Principles and Lawful Bases for Processing

A data user wants to rely on consent as its lawful basis. Which requirement best reflects a valid consent under the PDPA?

  1. Consent must be obtained in writing only, never electronically
  2. Consent must be a genuine indication of the data subject's wishes, given without undue pressure and after being informed Correct answer.
  3. Consent may be inferred from the data subject's silence
  4. Consent obtained by a manager on behalf of a customer is always valid

Explanation

Consent must be a genuine indication of the data subject's wishes, given freely and on the basis of adequate information about the purpose. It may be given in various forms, including electronically, and cannot be assumed from silence. One person cannot generally consent on another adult's behalf.

Question 46Data Protection Principles and Lawful Bases for Processing

What is the role of the Personal Data Protection Commissioner under the PDPA?

  1. To approve every marketing message before it is sent
  2. To enforce the Act, including investigating complaints and issuing enforcement notices Correct answer.
  3. To prosecute all civil disputes between data users
  4. To set interest rates for data processing fees

Explanation

The Commissioner is responsible for enforcing the PDPA, including receiving and investigating complaints, conducting inspections, and issuing enforcement notices and directions. The Commissioner does not adjudicate ordinary civil disputes or pre-approve marketing content. This supervisory role is central to the Act's administration.

Question 47Data Protection Principles and Lawful Bases for Processing

A direct marketing company wants to send promotional emails. Which principle most directly governs whether the recipient may opt out of receiving them?

  1. The integrity principle
  2. The choice principle Correct answer.
  3. The retention principle
  4. The security principle

Explanation

The choice principle requires that, where personal data is collected for a purpose, the data subject be given options to limit the processing, including the ability to opt out of direct marketing. The data user must honour the exercise of that choice. The other principles address accuracy, retention, and security rather than marketing preferences.

Question 48Data Protection Principles and Lawful Bases for Processing

Which statement about the data user's obligation regarding the source of personal data is correct?

  1. The data user need never disclose where it obtained the data
  2. The data user must obtain the source's consent before every use
  3. The data user must, in its notice, state the source from which the personal data was obtained where required Correct answer.
  4. The source is irrelevant to the PDPA

Explanation

The notice and choice principle requires the data user to inform the data subject of prescribed matters, which include the source from which the personal data was obtained where applicable. This transparency allows the subject to understand how the data came to be held. The source is not legally irrelevant, nor is a fresh consent from the source needed for every use.

Question 49Data Protection Principles and Lawful Bases for Processing

A data user receives a data access request but the request is incomplete. What is the most appropriate response under the PDPA?

  1. Reject it without explanation and destroy the data
  2. Ignore the request permanently
  3. Request the missing information needed to verify and process the request within the prescribed time Correct answer.
  4. Forward the request to the Commissioner for a decision

Explanation

A data user should respond to an access request within the prescribed period and may seek clarification where the request lacks information needed to identify the data or verify identity. Ignoring or summarily rejecting the request risks breaching the access principle. The Commissioner is not the first port of call for routine clarification.

Question 50Data Protection Principles and Lawful Bases for Processing

Which statement best captures the relationship between the security principle and a data user's outsourcing arrangements?

  1. A data user remains responsible for ensuring practical security safeguards apply, including through contractual and oversight measures with processors Correct answer.
  2. A data user may ignore security once data is handed to a processor
  3. Security only applies to paper records
  4. Security obligations transfer entirely to the processor and end for the data user

Explanation

The security principle requires the data user to take practical steps to protect personal data, and this responsibility extends to ensuring that processors engaged to handle data apply appropriate safeguards, typically through contract and oversight. The data user cannot simply wash its hands of the data. Security applies to both electronic and paper records.