I85PREP
⌘ K
ICS CDPP study materials
ICS CDPP study resources

ICS CDPP practice questions

One question at a time. Build your ICS CDPP understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Data Protection Law and Regulatory Frameworks

Under the GDPR, which lawful basis requires the controller to demonstrate that its interests are not overridden by the data subject's rights and freedoms?

  1. Contractual necessity
  2. Vital interests
  3. Legitimate interests Correct answer.
  4. Legal obligation

Explanation

Legitimate interests under Article 6(1)(f) is the only basis that requires a balancing test weighing the controller's interests against the data subject's rights and freedoms. The other bases do not involve such a balancing exercise.

Question 2Data Protection Law and Regulatory Frameworks

What is the maximum administrative fine the GDPR permits for the most serious infringements?

  1. 5 million euros or 1% of global annual turnover
  2. 10 million euros or 2% of global annual turnover
  3. 50 million euros or 5% of global annual turnover
  4. 20 million euros or 4% of global annual turnover, whichever is higher Correct answer.

Explanation

Article 83(5) sets the upper tier at 20 million euros or 4% of total worldwide annual turnover of the preceding financial year, whichever is higher. The lower tier in Article 83(4) is 10 million euros or 2%.

Question 3Data Protection Law and Regulatory Frameworks

Within what time period must a controller notify a personal data breach to the supervisory authority where notification is required?

  1. Within 24 hours of becoming aware
  2. Without undue delay and no later than 72 hours after becoming aware Correct answer.
  3. Within five business days of becoming aware
  4. Within 30 days of becoming aware

Explanation

Article 33 requires notification to the supervisory authority without undue delay and, where feasible, not later than 72 hours after the controller becomes aware of the breach. A delayed notification must be accompanied by reasons.

Question 4Data Protection Law and Regulatory Frameworks

Which principle limits processing to what is adequate, relevant and necessary for the stated purpose?

  1. Integrity and confidentiality
  2. Accuracy
  3. Storage limitation
  4. Data minimisation Correct answer.

Explanation

Data minimisation under Article 5(1)(c) requires personal data to be adequate, relevant and limited to what is necessary for the purposes. Storage limitation instead concerns how long data is kept.

Question 5Data Protection Law and Regulatory Frameworks

A company processes employee payroll data because tax law requires it. Which lawful basis is most appropriate?

  1. Public task
  2. Legitimate interests
  3. Consent
  4. Legal obligation Correct answer.

Explanation

Where processing is necessary to comply with a legal requirement such as tax reporting, Article 6(1)(c) legal obligation is the appropriate basis. Consent would be inappropriate because the processing is mandatory rather than optional.

Question 6Data Protection Law and Regulatory Frameworks

What role does a data protection officer primarily serve?

  1. To independently monitor compliance with data protection law within the organisation Correct answer.
  2. To approve every processing operation before it begins
  3. To manage the organisation's marketing consent database
  4. To act as the organisation's external legal counsel

Explanation

A DPO's core function under Article 39 is to monitor compliance, inform and advise the controller, and act as a contact point for the supervisory authority. The role is advisory and monitoring rather than executive approval of each activity.

Question 7Data Protection Law and Regulatory Frameworks

Under the GDPR, how long does a data subject generally have to receive a response to an access request?

  1. Ten working days with no possibility of extension
  2. One month, extendable by two further months for complex requests Correct answer.
  3. Six months from the date of the request
  4. Three months, extendable by one month

Explanation

Article 12(3) requires the controller to respond without undue delay and in any event within one month, which may be extended by two further months where requests are complex or numerous. The data subject must be informed of any extension.

Question 8Data Protection Law and Regulatory Frameworks

What does the principle of accountability require of a controller?

  1. Obtaining consent for all processing
  2. Publishing all personal data it holds
  3. Appointing a DPO in every case
  4. Demonstrating compliance with data protection principles and being able to prove it Correct answer.

Explanation

Article 5(2) makes the controller responsible for, and able to demonstrate, compliance with the data protection principles. This underpins obligations such as maintaining records and conducting assessments.

Question 9Data Protection Law and Regulatory Frameworks

A retailer wishes to send marketing emails to existing customers about similar products. Under the ePrivacy rules as commonly implemented in the EU, what is generally required?

  1. Written signed consent for each individual email
  2. No conditions, because the customer already purchased
  3. A prior opportunity to object, with an unsubscribe option in each message Correct answer.
  4. Prior opt-in consent in all cases

Explanation

The soft opt-in commonly permits marketing of similar products to existing customers where they were given an opportunity to object at collection and in every message. This is narrower than full prior consent but still requires an opt-out mechanism.

Question 10Data Protection Law and Regulatory Frameworks

What is the primary purpose of a data protection impact assessment?

  1. To document the financial cost of a processing project
  2. To register the controller with the supervisory authority
  3. To replace the need for a lawful basis
  4. To identify and mitigate high risks to data subjects before processing begins Correct answer.

Explanation

Article 35 requires a DPIA where processing is likely to result in a high risk to rights and freedoms, in order to assess and mitigate those risks before processing. It supplements but does not replace other obligations.

Question 11Data Protection Law and Regulatory Frameworks

Which of the following best describes the role of a processor under the GDPR?

  1. It processes personal data on behalf of and on the instructions of a controller Correct answer.
  2. It is exempt from any security obligations
  3. It determines the purposes and means of processing
  4. It is always jointly liable with the controller for regulatory fines

Explanation

Article 4(8) defines a processor as a natural or legal person that processes personal data on behalf of the controller. The controller determines purposes and means, while the processor acts on documented instructions.

Question 12Data Protection Law and Regulatory Frameworks

Under what circumstance is a controller required to appoint a data protection officer?

  1. Where core activities involve large-scale regular and systematic monitoring or large-scale special category data Correct answer.
  2. Whenever it employs more than ten staff
  3. Only when the supervisory authority issues a specific order
  4. Only if the controller operates in more than one member state

Explanation

Article 37 requires DPO designation where processing is carried out by a public authority, where core activities require large-scale regular and systematic monitoring, or where core activities involve large-scale processing of special category or criminal data.

Question 13Data Protection Law and Regulatory Frameworks

A data subject objects to processing based on legitimate interests. What must the controller generally do?

  1. Refer the request to the supervisory authority for a decision
  2. Automatically erase all data within 24 hours
  3. Cease processing unless it demonstrates compelling legitimate grounds that override the data subject's interests Correct answer.
  4. Continue processing unless the data subject pays a fee

Explanation

Under Article 21(1), on an objection to legitimate-interests processing the controller must stop unless it can show compelling legitimate grounds that override the data subject's interests, rights and freedoms. For direct marketing, the objection is absolute.

Question 14Data Protection Law and Regulatory Frameworks

Which transfer mechanism allows transfers of personal data to a third country without requiring a specific adequacy decision?

  1. Standard contractual clauses approved by the Commission Correct answer.
  2. A verbal agreement between the parties
  3. Binding corporate rules for a single controller
  4. Adequacy decision

Explanation

Standard contractual clauses are an Article 46 appropriate safeguard that can be used absent an adequacy decision. Adequacy decisions are a separate Article 45 mechanism.

Question 15Data Protection Law and Regulatory Frameworks

What does the right to data portability entitle a data subject to receive?

  1. A copy of the controller's internal policies
  2. A verbal summary of all processing activities
  3. Personal data provided to the controller, in a structured, commonly used, machine-readable format Correct answer.
  4. Only data collected with consent in paper form

Explanation

Article 20 gives the right to receive data provided by the data subject in a structured, commonly used and machine-readable format, and to transmit it to another controller. It applies to processing based on consent or contract carried out by automated means.

Question 16Data Protection Law and Regulatory Frameworks

A company discovers a breach affecting customers in several EU states. Which supervisory authority is generally the lead authority?

  1. The European Data Protection Board itself
  2. The authority of the member state where the controller has its main establishment in the EU Correct answer.
  3. The authority of the member state where the breach was first discovered
  4. The authority of the member state where the largest number of affected customers reside

Explanation

Under the one-stop-shop mechanism, the lead supervisory authority is generally that of the member state where the controller's main establishment in the EU is located. Other concerned authorities cooperate with the lead authority.

Question 17Data Protection Law and Regulatory Frameworks

What is the main effect of a Commission adequacy decision?

  1. It requires each transfer to be individually approved by the Commission
  2. It removes all data protection obligations from the exporter
  3. It applies only to transfers of special category data
  4. It permits transfers to the approved country without further specific safeguards Correct answer.

Explanation

An adequacy decision under Article 45 establishes that a third country ensures an adequate level of protection, allowing transfers without additional safeguards. The exporter must still comply with its own obligations.

Question 18Data Protection Law and Regulatory Frameworks

Which of the following is a special category of personal data under the GDPR?

  1. Job title
  2. Postal address
  3. Trade union membership Correct answer.
  4. Bank account number

Explanation

Article 9 lists special categories including racial or ethnic origin, political opinions, religious beliefs, health, sex life and trade union membership. Processing these is generally prohibited unless a specific exception applies.

Question 19Data Protection Law and Regulatory Frameworks

A controller wants to rely on consent for processing. Which characteristic is essential for that consent to be valid?

  1. It must be renewed every thirty days
  2. It must be given by a data protection officer
  3. It must be freely given, specific, informed and unambiguous Correct answer.
  4. It must be documented in a notarised deed

Explanation

Article 4(11) defines consent as any freely given, specific, informed and unambiguous indication of wishes. Silence, pre-ticked boxes or inactivity do not constitute valid consent.

Question 20Data Protection Law and Regulatory Frameworks

What does the principle of storage limitation require?

  1. Storing data only within the EU
  2. Storing data for a minimum of five years
  3. Keeping personal data no longer than necessary for the purposes Correct answer.
  4. Storing data only in encrypted form

Explanation

Article 5(1)(e) requires that personal data be kept in a form permitting identification of data subjects for no longer than necessary for the purposes. Retention periods should be defined and reviewed.

Question 21Data Protection Law and Regulatory Frameworks

A processor receives a request from a data subject to exercise access rights. What is the appropriate action?

  1. Forward the request to the controller and assist as instructed Correct answer.
  2. Refuse the request because processors have no obligations
  3. Respond directly to the data subject without informing the controller
  4. Delete the data subject's data immediately

Explanation

Under Article 28(3)(e), a processor must assist the controller in responding to data subject requests, taking into account the nature of the processing. The controller is responsible for handling and responding to the request.

Question 22Data Protection Law and Regulatory Frameworks

Which factor is most relevant to deciding whether processing amounts to 'large-scale' monitoring for DPO and DPIA purposes?

  1. Whether the controller uses cloud hosting
  2. The colour scheme of the company website
  3. The controller's annual marketing budget
  4. The number of data subjects concerned and the volume and variety of data Correct answer.

Explanation

Recital 91 and EDPB guidance indicate that large-scale assessment considers the number of data subjects, the volume and variety of data, and the duration and geographic extent of processing.

Question 23Data Protection Law and Regulatory Frameworks

A controller relies on legitimate interests for a profiling activity that produces legal effects on individuals. Which statement is most accurate?

  1. Consent is the only lawful basis for any profiling
  2. Profiling with legal effects is always permitted without conditions
  3. The controller must show the processing is necessary and conduct a balancing assessment, and individuals retain rights against solely automated decisions Correct answer.
  4. Legitimate interests can never support any profiling

Explanation

Legitimate interests requires a necessity and balancing assessment, and Article 22 restricts solely automated decisions producing legal or similarly significant effects. Individuals can object and request human intervention where Article 22 applies.

Question 24Data Protection Law and Regulatory Frameworks

A controller transfers data to a third-country processor using standard contractual clauses, but the importing country's surveillance laws may undermine the clauses. What must the controller consider?

  1. Nothing, because signed clauses always guarantee adequate protection
  2. Whether a transfer impact assessment shows effective supplementary measures are needed Correct answer.
  3. Only whether the processor has a DPO
  4. Whether the data subjects have consented to the transfer in all cases

Explanation

Following the Schrems II approach, exporters relying on Article 46 safeguards must assess the legal environment of the importing country and adopt supplementary measures where necessary to ensure essentially equivalent protection.

Question 25Data Protection Law and Regulatory Frameworks

A supervisory authority finds a controller infringed the obligation to conduct a DPIA where required. Which statement best reflects the GDPR enforcement position?

  1. DPIA failures are outside the authority's jurisdiction
  2. The authority may impose corrective measures and an administrative fine under the applicable tier Correct answer.
  3. Only a warning can ever be issued for a DPIA failure
  4. The controller can cure the failure by paying the data subjects

Explanation

Article 58 empowers authorities to impose corrective measures, and Article 83 permits fines for infringements of controller obligations, including DPIA failures, under the applicable tier. Enforcement is graduated but fines are available.

Question 26Data Protection Law and Regulatory Frameworks

Which principle requires that personal data be collected for specified, explicit and legitimate purposes and not further processed in a manner incompatible with those purposes?

  1. Integrity and confidentiality
  2. Data minimisation
  3. Purpose limitation Correct answer.
  4. Lawfulness, fairness and transparency

Explanation

Purpose limitation is the principle that restricts processing to the purposes specified at collection, unless a compatible further purpose applies. Data minimisation concerns the amount of data, integrity and confidentiality concerns security, and lawfulness, fairness and transparency concerns the legal basis and notice.

Question 27Data Protection Law and Regulatory Frameworks

Under the GDPR, which legal basis is most appropriate when a controller processes personal data to comply with a tax reporting obligation?

  1. Legitimate interests
  2. Legal obligation Correct answer.
  3. Consent
  4. Vital interests

Explanation

Processing is lawful under the legal obligation basis when it is necessary for compliance with a legal obligation to which the controller is subject. Consent is inappropriate because the processing is mandatory, legitimate interests cannot override a legal duty, and vital interests concern protecting someone's life.

Question 28Data Protection Law and Regulatory Frameworks

What is the maximum administrative fine that a supervisory authority may impose for a serious infringement of the GDPR's basic principles?

  1. 5 million euros or 1% of total worldwide annual turnover, whichever is higher
  2. 10 million euros or 2% of total worldwide annual turnover, whichever is higher
  3. 20 million euros or 4% of total worldwide annual turnover, whichever is higher Correct answer.
  4. 50 million euros or 10% of total worldwide annual turnover, whichever is higher

Explanation

The GDPR sets a two-tier fine structure; the higher tier, for infringements of the principles and other core obligations, is up to 20 million euros or 4% of total worldwide annual turnover, whichever is higher. The other figures do not correspond to the statutory maximum.

Question 29Data Protection Law and Regulatory Frameworks

Which right allows a data subject to obtain the erasure of personal data when the data are no longer necessary for the purposes for which they were collected?

  1. Right to object
  2. Right to restriction of processing
  3. Right to erasure Correct answer.
  4. Right to rectification

Explanation

The right to erasure (also known as the right to be forgotten) applies, among other grounds, when the data are no longer necessary for the purposes of processing. Restriction limits processing without deleting data, rectification corrects inaccurate data, and objection concerns processing based on certain legal bases.

Question 30Data Protection Law and Regulatory Frameworks

A controller engages a cloud provider to store personal data. The provider processes the data only on the controller's documented instructions. What is the provider's role under the GDPR?

  1. Supervisory authority
  2. Processor Correct answer.
  3. Joint controller
  4. Controller

Explanation

A processor is a natural or legal person that processes personal data on behalf of the controller. Because the cloud provider acts only on documented instructions, it is a processor, not a controller or joint controller, and it is certainly not a supervisory authority.

Question 31Data Protection Law and Regulatory Frameworks

When a controller uses a processor, which obligation must the controller ensure is in place?

  1. Adequacy decision for the processor's country
  2. A written contract that binds the processor to the controller's instructions Correct answer.
  3. Consent from every data subject for the processing
  4. Prior authorisation from the supervisory authority

Explanation

The GDPR requires a contract or other legal act between controller and processor that sets out the subject matter, duration, nature and purpose of processing, and binds the processor to the controller's instructions. An adequacy decision is only relevant for transfers outside the EEA, prior authorisation is not generally required, and consent is not always the applicable legal basis.

Question 32Data Protection Law and Regulatory Frameworks

A company wants to transfer personal data to a country for which the European Commission has adopted an adequacy decision. What is the main consequence of that decision?

  1. The company must appoint a representative in that country
  2. The transfer is prohibited unless standard contractual clauses are also signed
  3. Personal data may flow to that country without further transfer safeguards Correct answer.
  4. The company must still obtain explicit consent for each transfer

Explanation

An adequacy decision means the Commission has determined that the third country ensures an adequate level of protection, so transfers may take place without additional safeguards. Consent, a local representative, or SCCs are not required solely because of the transfer.

Question 33Data Protection Law and Regulatory Frameworks

Which of the following is a valid way for a controller to demonstrate compliance with the GDPR without needing prior authorisation from a supervisory authority?

  1. Adopting approved codes of conduct or certification mechanisms Correct answer.
  2. Transferring all data outside the EEA
  3. Obtaining consent from employees for all processing
  4. Relying on an unwritten internal policy

Explanation

The GDPR encourages the use of approved codes of conduct and certification mechanisms as tools to demonstrate compliance with controller and processor obligations. Unwritten policies, employee consent for all processing, and transferring data outside the EEA are not recognised compliance-demonstration tools.

Question 34Data Protection Law and Regulatory Frameworks

A data subject requests access to their personal data. In which situation may the controller generally refuse the request?

  1. When the controller is a small enterprise
  2. When the data subject has previously objected to processing
  3. When the request is manifestly unfounded or excessive Correct answer.
  4. When the data were collected from a third party

Explanation

The controller may refuse or charge a reasonable fee when a request is manifestly unfounded or excessive, in particular because of its repetitive character. Previous objection, third-party source, or small enterprise size are not grounds for refusal.

Question 35Data Protection Law and Regulatory Frameworks

Which statement best describes the role of the European Data Protection Board (EDPB)?

  1. It issues guidelines and ensures consistent application of the GDPR across the EU Correct answer.
  2. It adopts adequacy decisions for third countries
  3. It imposes fines directly on controllers
  4. It acts as the lead supervisory authority for all cross-border processing

Explanation

The EDPB is an independent body that contributes to the consistent application of the GDPR, including by issuing guidelines, recommendations and best practices. It does not act as a lead supervisory authority, adopt adequacy decisions, or impose fines directly.

Question 36Data Protection Law and Regulatory Frameworks

A controller receives a request from a data subject to restrict processing. Which action is most appropriate while the controller verifies the accuracy of the data?

  1. Transfer the data to a third country
  2. Delete all personal data immediately
  3. Continue processing as normal
  4. Restrict processing until accuracy is verified Correct answer.

Explanation

Where a data subject contests the accuracy of the data, the controller must restrict processing for a period enabling verification of accuracy. Immediate deletion, continued processing, or transfer are not appropriate responses to a restriction request.

Question 37Data Protection Law and Regulatory Frameworks

Under the GDPR, when must a controller provide information to a data subject when the data are obtained indirectly (not from the data subject)?

  1. Within a reasonable period, and at the latest within one month Correct answer.
  2. No information is required for indirectly obtained data
  3. Only if the data subject requests it
  4. Within 72 hours of collection

Explanation

When personal data are not obtained from the data subject, the controller must provide the required information within a reasonable period after obtaining the data, and at the latest within one month, having regard to the specific circumstances. The other timeframes or conditions are incorrect.

Question 38Data Protection Law and Regulatory Frameworks

A controller based in France uses a processor in Germany for a service that affects data subjects in both countries. Which supervisory authority is competent to act as lead authority for the cross-border processing?

  1. The French supervisory authority, as the controller's main establishment is in France Correct answer.
  2. The German supervisory authority, because the processor is located there
  3. The supervisory authority of each Member State where a data subject is affected
  4. The European Data Protection Board

Explanation

The lead supervisory authority is generally the supervisory authority of the Member State where the controller or processor has its main establishment. Here that is France, so the French authority is lead; the processor's location, the EDPB, or every affected Member State's authority do not determine lead competence.

Question 39Data Protection Law and Regulatory Frameworks

Which of the following best describes the one-stop-shop mechanism under the GDPR?

  1. A controller with a main establishment in one Member State deals with a single lead supervisory authority for cross-border processing Correct answer.
  2. A data subject may file a complaint only with the authority in their own Member State
  3. Each Member State must adopt identical national data protection laws
  4. The European Commission acts as the sole supervisory authority for the EU

Explanation

The one-stop-shop mechanism allows a controller or processor with a main establishment in one Member State to have a single lead supervisory authority for cross-border processing. It does not restrict complaints to the home authority, require identical national laws, or make the Commission a supervisory authority.

Question 40Data Protection Law and Regulatory Frameworks

A controller plans to process personal data for a new purpose that is incompatible with the original purpose. Which condition must be met for the new processing to be lawful?

  1. The new purpose is always permitted if the data subject does not object
  2. The original consent automatically extends to the new purpose
  3. The controller may rely on the original purpose limitation exception
  4. A new legal basis under Article 6 must be identified for the new purpose Correct answer.

Explanation

Further processing for an incompatible purpose requires a new legal basis under Article 6; the original basis does not automatically extend. Consent does not automatically extend, the purpose limitation exception applies only to compatible purposes, and silence does not create a legal basis.

Question 41Data Protection Principles and Lawful Bases for Processing

Under the UK GDPR, which lawful basis requires the controller to demonstrate that its interests are not overridden by the individual's rights and freedoms?

  1. Vital interests
  2. Contract
  3. Legitimate interests Correct answer.
  4. Consent

Explanation

Legitimate interests is the only lawful basis that requires a balancing test, weighing the controller's or a third party's interests against the individual's rights and freedoms. Consent, contract and vital interests do not carry this balancing requirement.

Question 42Data Protection Principles and Lawful Bases for Processing

Which principle limits the collection of personal data to what is adequate, relevant and necessary for the stated purpose?

  1. Accountability
  2. Data minimisation Correct answer.
  3. Storage limitation
  4. Integrity and confidentiality

Explanation

Data minimisation requires personal data to be adequate, relevant and limited to what is necessary for the purposes. Storage limitation concerns retention periods, while integrity and confidentiality concerns security.

Question 43Data Protection Principles and Lawful Bases for Processing

A company wants to rely on consent for marketing emails. Which characteristic must that consent have to be valid?

  1. It must be obtained in writing and signed
  2. It must be renewed every month
  3. It must be confirmed by a witness
  4. It must be freely given, specific, informed and unambiguous Correct answer.

Explanation

Valid consent must be freely given, specific, informed and an unambiguous indication of the individual's wishes, expressed by a statement or clear affirmative action. There is no general requirement for a signature, witness or monthly renewal.

Question 44Data Protection Principles and Lawful Bases for Processing

Which lawful basis applies when processing is necessary to protect someone's life?

  1. Legal obligation
  2. Legitimate interests
  3. Vital interests Correct answer.
  4. Public task

Explanation

Vital interests covers processing necessary to protect the vital interests of the individual or another person, typically life-or-death situations. The other bases address public functions, legal duties or balanced interests.

Question 45Data Protection Principles and Lawful Bases for Processing

What does the purpose limitation principle require of a controller?

  1. Encrypting all data at rest
  2. Collecting data only from public sources
  3. Using data only for specified, explicit and legitimate purposes Correct answer.
  4. Keeping data no longer than necessary

Explanation

Purpose limitation requires personal data to be collected for specified, explicit and legitimate purposes and not further processed in an incompatible manner. Retention and security are governed by separate principles.

Question 46Data Protection Principles and Lawful Bases for Processing

Which principle requires a controller to be able to demonstrate compliance with data protection rules?

  1. Lawfulness
  2. Accountability Correct answer.
  3. Accuracy
  4. Fairness

Explanation

Accountability requires the controller to take responsibility for compliance and to be able to demonstrate it, for example through policies and records. The other principles concern fairness, accuracy and lawful processing.

Question 47Data Protection Principles and Lawful Bases for Processing

Which lawful basis applies where processing is necessary for a task carried out in the public interest or in the exercise of official authority?

  1. Contract
  2. Vital interests
  3. Public task Correct answer.
  4. Consent

Explanation

The public task basis covers processing necessary for the performance of a task in the public interest or in the exercise of official authority vested in the controller. It is distinct from contract, consent and vital interests.

Question 48Data Protection Principles and Lawful Bases for Processing

Which of the following best describes special category personal data?

  1. Data held only in paper records
  2. Any data about a company's customers
  3. Data that has been pseudonymised
  4. Data revealing racial or ethnic origin, health or religious beliefs Correct answer.

Explanation

Special category data includes data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data for identification, health data, and data concerning sex life or sexual orientation. Processing it requires an additional condition beyond a lawful basis.

Question 49Data Protection Principles and Lawful Bases for Processing

An online retailer wants to use a customer's email address to send a newsletter and relies on consent. The customer later withdraws consent. What should the retailer do?

  1. Continue sending because the email was already collected
  2. Stop the marketing and honour the withdrawal Correct answer.
  3. Ask a colleague to re-confirm the consent
  4. Switch to legitimate interests without notifying the customer

Explanation

Where processing is based on consent, the individual has the right to withdraw it at any time, and withdrawal must be as easy as giving consent. Once validly withdrawn, the controller must stop the consent-based processing.

Question 50Data Protection Principles and Lawful Bases for Processing

A hospital processes patient health data to provide treatment. Which additional condition is most likely to apply alongside a lawful basis?

  1. Performance of a contract with a supplier
  2. Provision of health or social care Correct answer.
  3. Legitimate interests
  4. Vital interests of a third party

Explanation

Special category data such as health information requires an additional condition under the relevant legislation; provision of health or social care is a recognised condition. Legitimate interests and supplier contracts are lawful bases, not special category conditions.