I85PREP
⌘ K
ICDL Data Protection study materials
ICDL Data Protection study resources

ICDL Data Protection (ICDL) practice questions

One question at a time. Build your ICDL Data Protection understanding.

First 50 of 196 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Concepts

Under the GDPR, which term describes any information relating to an identified or identifiable natural person?

  1. Aggregate reporting
  2. Metadata
  3. Anonymised statistics
  4. Personal data Correct answer.

Explanation

Personal data is defined as any information relating to an identified or identifiable natural person. The concept hinges on identifiability, whether directly or indirectly. Data that cannot be linked to a person falls outside this definition.

Question 2Concepts

Which of the following is a special category of personal data under the GDPR?

  1. Racial or ethnic origin Correct answer.
  2. Company registration number
  3. Postal address
  4. Job title

Explanation

Special categories include data revealing racial or ethnic origin, political opinions, religious beliefs, health, sex life or sexual orientation, and biometric or genetic data used for identification. These require additional legal conditions to process. Ordinary business and contact details are not special category data.

Question 3Concepts

What is the role of a data controller?

  1. The party that hosts servers on behalf of another organisation
  2. The supervisory authority that enforces data protection law
  3. The party that determines the purposes and means of processing personal data Correct answer.
  4. The individual whose personal data is being processed

Explanation

The controller decides why and how personal data is processed and bears primary accountability for compliance. Processors act on the controller's instructions, and supervisory authorities are regulators. The individual is the data subject.

Question 4Concepts

Which principle requires that personal data be collected for specified, explicit and legitimate purposes?

  1. Storage limitation
  2. Integrity and confidentiality
  3. Purpose limitation Correct answer.
  4. Accuracy

Explanation

Purpose limitation means data must be collected for specified, explicit and legitimate purposes and not further processed incompatibly. Storage limitation concerns how long data is kept, while accuracy concerns correctness. Integrity and confidentiality concerns security.

Question 5Concepts

A company keeps customer records indefinitely because deletion 'might be useful someday'. Which principle does this most directly breach?

  1. Transparency
  2. Storage limitation Correct answer.
  3. Lawfulness
  4. Fairness

Explanation

Storage limitation requires that data be kept no longer than necessary for the purpose. Retaining records indefinitely without justification breaches that principle. The other principles concern legal basis, openness and fair treatment rather than retention periods.

Question 6Concepts

What does the principle of data minimisation require?

  1. Encrypting all data at rest
  2. Collecting only the data adequate and relevant to the purpose Correct answer.
  3. Obtaining consent from every individual
  4. Keeping data only on a single server

Explanation

Data minimisation requires that personal data be adequate, relevant and limited to what is necessary for the purpose. It is about the scope of collection, not the technical storage setup. Encryption and consent are separate compliance measures.

Question 7Concepts

Which lawful basis under the GDPR involves the individual giving a clear, affirmative indication of agreement to processing?

  1. Consent Correct answer.
  2. Contract
  3. Legal obligation
  4. Legitimate interests

Explanation

Consent is a freely given, specific, informed and unambiguous indication of the data subject's wishes. It must be expressed by a clear affirmative action. Legitimate interests, contract and legal obligation are separate bases that do not rely on agreement.

Question 8Concepts

A website pre-ticks a newsletter sign-up box that users must untick to decline. Why is this consent problematic?

  1. It used a checkbox rather than a button
  2. It was offered free of charge
  3. It was not signed in writing
  4. It lacks a clear affirmative action by the user Correct answer.

Explanation

Valid consent requires a clear affirmative action, so pre-ticked boxes do not constitute valid consent. Consent does not need to be in writing or signed, and offering it at no cost is normal. The interface control type is not the issue.

Question 9Concepts

What is the main purpose of the transparency principle?

  1. To make processing understandable and open to data subjects Correct answer.
  2. To guarantee that data is never shared
  3. To ensure data is stored within the EU
  4. To limit the number of staff who can access data

Explanation

Transparency requires that individuals be informed clearly about how their data is used, supporting their ability to exercise rights. It is not a restriction on staff access, a localisation rule, or a ban on sharing.

Question 10Concepts

Which right allows an individual to obtain a copy of the personal data an organisation holds about them?

  1. Right of access Correct answer.
  2. Right to data portability
  3. Right to object
  4. Right to erasure

Explanation

The right of access lets individuals request confirmation of processing and a copy of their personal data. Erasure concerns deletion, portability concerns moving data between services, and objection concerns stopping certain processing.

Question 11Concepts

An individual asks a retailer to delete their account data, but the retailer must retain invoices for tax purposes. What is the appropriate response?

  1. Refuse the entire request without explanation
  2. Erase the data not subject to a legal retention duty and explain the retained records Correct answer.
  3. Transfer the request to the tax authority
  4. Delete all records including the invoices

Explanation

The right to erasure is not absolute; data that must be retained to comply with a legal obligation can be kept. The organisation should erase what it can and inform the individual about the retained data and the reason. Deleting legally required records would breach other duties.

Question 12Concepts

What does the right to data portability entitle an individual to do?

  1. Prevent any organisation from ever processing their data
  2. Review the internal security policies of the organisation
  3. Receive their data in a structured, machine-readable format for transfer Correct answer.
  4. Demand that all data be deleted within 24 hours

Explanation

Portability allows individuals to receive data they provided in a structured, commonly used, machine-readable format and to have it transmitted to another controller where technically feasible. It is not a deletion right or a blanket processing ban.

Question 13Concepts

Which action best illustrates the principle of accuracy?

  1. Correcting a customer's misspelled address on request Correct answer.
  2. Backing up databases nightly
  3. Restricting access to payroll records
  4. Informing customers about a privacy policy update

Explanation

Accuracy requires that personal data be correct and, where necessary, kept up to date, including correcting inaccurate data on request. Backups, access restriction and notices address other principles.

Question 14Concepts

Under the GDPR, within what period must a controller generally respond to a data subject access request?

  1. Six months
  2. Seven days
  3. There is no fixed deadline
  4. One month, extendable by two further months for complex requests Correct answer.

Explanation

Controllers must respond without undue delay and generally within one month, which can be extended by up to two further months where requests are complex or numerous. The individual must be informed of any extension.

Question 15Concepts

What is a personal data breach?

  1. Any planned maintenance of a database
  2. A security incident leading to accidental or unlawful destruction, loss, alteration or unauthorised disclosure of personal data Correct answer.
  3. A delay in responding to a subject access request
  4. A change to an organisation's privacy notice

Explanation

A personal data breach is a security incident affecting the confidentiality, integrity or availability of personal data, such as loss, alteration or unauthorised disclosure. Routine maintenance, response delays and policy updates are not breaches by definition.

Question 16Concepts

A controller becomes aware of a breach likely to result in a risk to individuals' rights. Within what period must it generally notify the supervisory authority?

  1. 24 hours of becoming aware
  2. One calendar year
  3. 30 days of becoming aware
  4. 72 hours of becoming aware Correct answer.

Explanation

Where a breach is likely to result in a risk to rights and freedoms, the controller must notify the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware. Notification to affected individuals is required where the risk is high.

Question 17Concepts

When must a controller communicate a personal data breach directly to affected individuals?

  1. Only after the supervisory authority approves the wording
  2. Only when the breach is likely to result in a high risk to their rights and freedoms Correct answer.
  3. Only if a journalist requests it
  4. Whenever any breach occurs, regardless of risk

Explanation

Individual notification is required when a breach is likely to result in a high risk to the rights and freedoms of data subjects. Lower-risk breaches may only require notification to the authority. Communication should describe the nature of the breach and mitigation steps.

Question 18Concepts

What does the accountability principle require of an organisation?

  1. Transferring all liability to its processors
  2. Publishing every individual's data online
  3. Demonstrating compliance with data protection rules and being able to prove it Correct answer.
  4. Avoiding the use of any third-party services

Explanation

Accountability requires the controller to take responsibility for compliance and to demonstrate it, for example through policies, records and assessments. Liability cannot simply be shifted to processors, and the principle does not involve publishing data or banning suppliers.

Question 19Concepts

What is the main function of a data protection impact assessment (DPIA)?

  1. To record employee holiday entitlements
  2. To identify and mitigate risks before processing that is likely to be high risk Correct answer.
  3. To replace the need for a privacy notice
  4. To calculate the financial value of a database

Explanation

A DPIA is carried out before processing likely to result in a high risk, to describe the processing, assess risks and identify mitigation measures. It supports accountability but does not replace transparency obligations or serve unrelated administrative purposes.

Question 20Concepts

An organisation plans to deploy facial recognition to monitor employees' attendance. Why is a DPIA particularly important here?

  1. Because DPIAs are only needed for marketing campaigns
  2. Because it removes the need to inform employees
  3. Because attendance data is never personal data
  4. Because biometric processing for identification is likely to be high risk Correct answer.

Explanation

Processing biometric data for unique identification is explicitly likely to result in high risk, so a DPIA is expected before processing begins. Attendance data is personal data, and a DPIA does not remove transparency duties.

Question 21Concepts

What is a data processor?

  1. The regulator that oversees data protection
  2. An individual whose data is processed
  3. A party that processes personal data on behalf of a controller Correct answer.
  4. A party that decides the purposes of processing

Explanation

A processor handles personal data on behalf of, and on the instructions of, a controller. The controller determines the purposes, the individual is the data subject, and the regulator is the supervisory authority.

Question 22Concepts

A controller engages a cloud provider to store customer data. What should the arrangement include to comply with data protection rules?

  1. A transfer of all controller responsibilities to the provider
  2. A written contract setting out the processor's obligations and the controller's instructions Correct answer.
  3. An informal verbal agreement only
  4. A clause permitting the provider to use the data for its own marketing

Explanation

Processing by a processor must be governed by a written contract that sets out the subject matter, duration, nature and purpose of processing and the processor's obligations. The controller remains responsible, and the processor may not use the data for its own purposes.

Question 23Concepts

Which statement best describes the relationship between a controller and a processor?

  1. The processor decides the purposes and the controller provides the servers
  2. Both parties are always jointly and equally responsible for all decisions
  3. The controller sets the purposes and the processor acts on its documented instructions Correct answer.
  4. The processor is the data subject and the controller is the regulator

Explanation

The controller determines the purposes and means of processing, and the processor acts only on the controller's documented instructions. Joint controllership can arise in specific circumstances but is not automatic in every relationship.

Question 24Concepts

What does the principle of integrity and confidentiality require?

  1. That all data be made publicly available
  2. That data be kept forever for audit purposes
  3. That personal data be processed in a manner that ensures appropriate security Correct answer.
  4. That only the managing director may see any data

Explanation

Integrity and confidentiality require appropriate technical and organisational measures to protect data against unauthorised or unlawful processing and against accidental loss, destruction or damage. It is about security, not publication, indefinite retention or a single-person access rule.

Question 25Concepts

An organisation collects full dates of birth when only the year of birth is needed to verify age eligibility. Which principle is most directly engaged?

  1. Storage limitation
  2. Data minimisation Correct answer.
  3. Integrity and confidentiality
  4. Accountability

Explanation

Collecting more detail than necessary for the stated purpose engages data minimisation, which requires data to be adequate, relevant and limited to what is necessary. The issue is the scope of collection rather than retention, demonstrable compliance or security.

Question 26Concepts

What is the primary purpose of data protection legislation?

  1. To protect individuals' fundamental rights and freedoms regarding their personal data Correct answer.
  2. To require encryption of all personal data at rest
  3. To ensure all data is stored within the European Union
  4. To prevent companies from using computers for marketing

Explanation

Data protection law aims to safeguard individuals' rights and freedoms, particularly their right to privacy, when their personal data is processed. It does not ban marketing, mandate local storage, or universally require encryption.

Question 27Concepts

Which of the following is considered personal data?

  1. A product's serial number
  2. A person's email address Correct answer.
  3. The average temperature in a city
  4. A company's registration number

Explanation

Personal data is any information relating to an identified or identifiable natural person. An email address can identify a person, so it is personal data. Company registration numbers, weather data, and product serial numbers do not relate to individuals.

Question 28Concepts

What is a data subject under data protection law?

  1. An individual whose personal data is being processed Correct answer.
  2. A supervisory authority that monitors compliance
  3. The organisation that decides why and how personal data is processed
  4. A third party that processes data on behalf of another organisation

Explanation

The data subject is the identified or identifiable natural person to whom personal data relates. The controller and processor are organisations involved in processing, while the supervisory authority oversees compliance.

Question 29Concepts

What does the principle of storage limitation require?

  1. Personal data must be stored in a secure location
  2. Personal data must be kept for no longer than necessary for the purpose Correct answer.
  3. Personal data must be stored in the cloud
  4. Personal data must be backed up daily

Explanation

Storage limitation means data should not be kept in identifiable form for longer than needed for the processing purpose. Security and backup are separate concerns, and there is no requirement to use the cloud.

Question 30Concepts

What is the role of a Data Protection Officer (DPO)?

  1. To independently advise on and monitor data protection compliance Correct answer.
  2. To market products to customers
  3. To manage the organisation's IT helpdesk
  4. To represent the organisation in court

Explanation

A DPO informs and advises the organisation on data protection obligations, monitors compliance, and acts as a contact point for supervisory authorities and individuals. The role is independent and does not involve marketing, legal representation, or IT support.

Question 31Concepts

Which of the following is a valid lawful basis for processing personal data under the GDPR?

  1. The data subject has given consent Correct answer.
  2. The processing is for the organisation's convenience
  3. The data subject is a customer
  4. The data is publicly available

Explanation

The GDPR lists six lawful bases: consent, contract, legal obligation, vital interests, public task, and legitimate interests. Public availability, organisational convenience, and customer status are not lawful bases in themselves.

Question 32Concepts

What does the right to rectification allow an individual to do?

  1. Object to processing
  2. Request deletion of their data
  3. Have inaccurate personal data corrected Correct answer.
  4. Obtain a copy of their data

Explanation

The right to rectification enables individuals to have inaccurate personal data corrected without undue delay. Deletion, access, and objection are separate rights.

Question 33Concepts

What does the principle of lawfulness, fairness and transparency require?

  1. Processing must be approved by a supervisory authority
  2. Processing must have a legal basis, respect individuals' expectations, and be communicated clearly Correct answer.
  3. Processing must be done in a transparent office
  4. Processing must always be based on consent

Explanation

This principle requires that personal data is processed lawfully (with a valid basis), fairly (without unjustified adverse effects), and transparently (with clear information to individuals). Consent is only one possible basis, and supervisory approval is not generally required.

Question 34Concepts

Under what circumstance is an organisation required to designate a Data Protection Officer?

  1. When it has more than 10 employees
  2. Whenever it processes any personal data
  3. When it uses cloud computing services
  4. When its core activities involve large-scale systematic monitoring or special category data Correct answer.

Explanation

A DPO must be designated where processing is carried out by a public authority, where core activities require regular and systematic monitoring of data subjects on a large scale, or where core activities consist of large-scale processing of special categories of data. Processing any data or having a certain number of employees does not automatically trigger the requirement.

Question 35Concepts

What is the main purpose of a record of processing activities (ROPA)?

  1. To list all employees and their contact details
  2. To document all processing operations for accountability and supervisory review Correct answer.
  3. To provide a marketing database
  4. To record customer complaints

Explanation

A ROPA is a record of processing activities that helps organisations demonstrate accountability and allows supervisory authorities to assess compliance. It is not a staff directory, complaint log, or marketing tool.

Question 36Concepts

Which principle requires that personal data be adequate, relevant and limited to what is necessary?

  1. Integrity and confidentiality
  2. Data minimisation Correct answer.
  3. Storage limitation
  4. Accuracy

Explanation

Data minimisation requires that personal data be adequate, relevant, and limited to what is necessary in relation to the purposes for which they are processed. Accuracy concerns correctness, storage limitation concerns retention periods, and integrity and confidentiality concern security.

Question 37Concepts

What does the right to restriction of processing allow an individual to do?

  1. Demand that their data be deleted immediately
  2. Receive a copy of their data in a machine-readable format
  3. Transfer their data to another organisation
  4. Limit the processing of their data while a dispute is resolved Correct answer.

Explanation

The right to restriction allows individuals to limit processing, for example while accuracy is contested or the lawfulness of processing is being assessed. Deletion, portability, and access are separate rights.

Question 38Concepts

An organisation relies on legitimate interests as its lawful basis. What must it do before processing?

  1. Notify the supervisory authority
  2. Conduct a balancing test to ensure its interests do not override individuals' rights Correct answer.
  3. Obtain explicit consent from the data subject
  4. Appoint a Data Protection Officer

Explanation

When relying on legitimate interests, the organisation must perform a three-part test: identify the legitimate interest, show that processing is necessary, and balance it against individuals' rights and freedoms. Consent is not required, and supervisory notification or a DPO is not automatically mandated.

Question 39Concepts

What is the main purpose of a privacy notice?

  1. To advertise the organisation's products
  2. To obtain consent for all processing
  3. To inform individuals about how their personal data is used Correct answer.
  4. To serve as a contract with the data subject

Explanation

A privacy notice provides transparent information about processing, such as purposes, lawful basis, recipients, and rights. It is not a consent form, a contract, or marketing material.

Question 40Concepts

Which of the following best describes the role of a supervisory authority?

  1. To process personal data on behalf of controllers
  2. To represent data subjects in legal disputes
  3. To monitor and enforce compliance with data protection law Correct answer.
  4. To provide IT security services to organisations

Explanation

A supervisory authority is an independent public body that monitors and enforces compliance with data protection law, handles complaints, and may impose fines. It does not process data for controllers, provide IT services, or act as a legal representative for individuals.

Question 41Concepts

A company wants to transfer personal data to a country outside the EU/EEA that has not received an adequacy decision. What must the company ensure?

  1. That the transfer is approved by the company's DPO
  2. That the data subject has consented to the transfer
  3. That the data is encrypted during transfer
  4. That appropriate safeguards, such as standard contractual clauses, are in place Correct answer.

Explanation

For transfers to countries without an adequacy decision, the controller must put in place appropriate safeguards, such as standard contractual clauses or binding corporate rules. Consent is one possible derogation but not the general requirement; DPO approval and encryption alone are not sufficient.

Question 42Concepts

What is the main difference between anonymisation and pseudonymisation?

  1. Anonymisation irreversibly removes identifiability, while pseudonymisation allows re-identification with additional information Correct answer.
  2. Anonymisation applies only to special category data
  3. Pseudonymisation is required by law, while anonymisation is optional
  4. Anonymised data can be re-identified, while pseudonymised data cannot

Explanation

Anonymisation means data can no longer be linked to an individual by any means, so it falls outside data protection law. Pseudonymisation replaces identifiers but allows re-identification when additional information is used, so the data remains personal data.

Question 43Concepts

An organisation processes personal data for a new purpose that is incompatible with the original purpose. What must it do?

  1. Nothing, because the data was lawfully obtained
  2. Obtain a new lawful basis for the new purpose and inform individuals Correct answer.
  3. Inform the supervisory authority within 72 hours
  4. Delete all data immediately

Explanation

The purpose limitation principle requires that data be collected for specified, explicit, and legitimate purposes and not further processed in an incompatible manner. For incompatible further processing, a new lawful basis is needed and individuals must be informed.

Question 44Concepts

What is the role of the European Data Protection Board (EDPB)?

  1. To provide cybersecurity software to organisations
  2. To ensure consistent application of the GDPR across the EU Correct answer.
  3. To issue binding decisions in individual data protection cases
  4. To process data subject access requests for all EU citizens

Explanation

The EDPB is an independent body that contributes to the consistent application of the GDPR, issues guidelines, and advises the European Commission. It does not decide individual cases (that is for supervisory authorities) or handle access requests or provide software.

Question 45Concepts

Which of the following is an example of processing personal data?

  1. Reading a public newspaper
  2. Storing paper files in a locked cabinet
  3. Sending an empty email
  4. Collecting and recording a customer's name and address Correct answer.

Explanation

Processing includes any operation performed on personal data, such as collection, recording, storage, and retrieval. Reading a newspaper or sending an empty email does not involve personal data, and storage in a cabinet is also processing but the collection and recording example is more clearly an active processing operation.

Question 46Concepts

What is the consequence of a controller failing to comply with a data subject access request without justification?

  1. The controller must delete all personal data immediately
  2. The controller must provide the data free of charge within 24 hours
  3. The controller must appoint a new DPO
  4. The controller may be subject to a complaint to the supervisory authority and potential fines Correct answer.

Explanation

Failure to comply with a data subject access request can lead to complaints to the supervisory authority, which may impose fines and other corrective measures. The GDPR does not require a 24-hour response or automatic deletion, and appointing a DPO is unrelated.

Question 47Concepts

What is the main purpose of the accountability principle?

  1. To require consent for all processing activities
  2. To require organisations to demonstrate compliance with data protection rules Correct answer.
  3. To make data protection officers personally liable for breaches
  4. To ensure all data breaches are reported to the police

Explanation

Accountability requires controllers to take responsibility for compliance and be able to demonstrate it, for example through policies, records, and audits. It does not mandate police reporting, personal liability for DPOs, or universal consent.

Question 48Concepts

An organisation relies on consent as its lawful basis. A data subject later withdraws consent. What is the effect?

  1. Processing can continue because consent was initially valid
  2. The data subject must pay a fee to withdraw consent
  3. The organisation must delete all data within 24 hours
  4. Processing must stop unless another lawful basis applies Correct answer.

Explanation

Withdrawal of consent must be as easy as giving it, and once withdrawn, processing based on consent must cease unless another lawful basis applies. Withdrawal is free, and deletion timelines depend on other rules.

Question 49Concepts

Which of the following best explains why data protection law treats biometric data used for unique identification as a special category?

  1. Because it is not considered personal data
  2. Because it is inherently sensitive and can lead to significant risks if misused Correct answer.
  3. Because it is only collected by public authorities
  4. Because it is always stored in the cloud

Explanation

Biometric data for unique identification is considered sensitive because it is unique to an individual, cannot be changed, and misuse can lead to identity theft or discrimination. It is not defined by storage location, collector, or exclusion from personal data.

Question 50Concepts

What is the significance of the 'one-stop-shop' mechanism under the GDPR?

  1. It allows individuals to file complaints with any supervisory authority
  2. It mandates a single privacy notice for all EU member states
  3. It designates a lead supervisory authority for cross-border processing to streamline cooperation Correct answer.
  4. It requires all organisations to use a single data processor

Explanation

The one-stop-shop mechanism provides that, for cross-border processing, a lead supervisory authority is designated to coordinate supervision, with other authorities involved. It does not restrict complaints, require a single processor, or mandate a single privacy notice.