I85PREP
⌘ K
ICS ECDPO study materials
ICS ECDPO study resources

ICS ECDPO practice questions

One question at a time. Build your ICS ECDPO understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Data Protection Principles and Legal Frameworks

Under the GDPR, which principle requires that personal data be collected for specified, explicit and legitimate purposes and not further processed in a manner incompatible with those purposes?

  1. Integrity and confidentiality
  2. Storage limitation
  3. Purpose limitation Correct answer.
  4. Data minimisation

Explanation

Purpose limitation requires that controllers only collect data for specified, explicit and legitimate purposes and prohibits incompatible further processing. The other principles address different concerns such as adequacy of data volume, retention duration, and security.

Question 2Data Protection Principles and Legal Frameworks

A company collects customer email addresses to deliver order confirmations. Which GDPR principle is most directly engaged if the company later uses those addresses to send unrelated marketing without a lawful basis?

  1. Lawfulness, fairness and transparency
  2. Accuracy
  3. Purpose limitation Correct answer.
  4. Storage limitation

Explanation

Reusing data for a new, incompatible purpose breaches purpose limitation, which restricts further processing to compatible purposes or requires a fresh lawful basis. Marketing use is generally incompatible with transactional order communication unless a lawful basis exists.

Question 3Data Protection Principles and Legal Frameworks

Which principle requires that personal data be adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed?

  1. Fairness
  2. Data minimisation Correct answer.
  3. Accountability
  4. Accuracy

Explanation

Data minimisation requires that only data adequate, relevant and necessary for the stated purpose is processed. It is the principle that limits the scope and volume of collection.

Question 4Data Protection Principles and Legal Frameworks

A retailer collects full dates of birth from all customers solely to send birthday discount codes. Which critique is most consistent with the data minimisation principle?

  1. Collecting only day and month would suffice, so the full date exceeds what is necessary. Correct answer.
  2. The retailer should retain the data indefinitely to support future campaigns.
  3. The retailer must obtain consent from every customer regardless of other factors.
  4. Collecting birth dates for birthday codes is inherently unlawful.

Explanation

Data minimisation asks whether the data is limited to what is necessary for the purpose. If only day and month are needed for birthday codes, collecting the full date exceeds necessity. Lawfulness and consent are separate questions from minimisation.

Question 5Data Protection Principles and Legal Frameworks

Which principle requires personal data to be kept in a form that permits identification of data subjects for no longer than is necessary for the purposes of the processing?

  1. Purpose limitation
  2. Storage limitation Correct answer.
  3. Data minimisation
  4. Integrity and confidentiality

Explanation

Storage limitation governs retention duration, requiring that identifiable data is not kept longer than necessary. It complements purpose limitation, which governs why data is processed.

Question 6Data Protection Principles and Legal Frameworks

A controller keeps customer records indefinitely 'just in case' without any defined retention schedule. Which principle is most directly violated?

  1. Data minimisation
  2. Accuracy
  3. Fairness
  4. Storage limitation Correct answer.

Explanation

Storage limitation requires defined retention periods tied to necessity and prohibits keeping identifiable data longer than needed. An indefinite 'just in case' retention lacks a necessity-based limit.

Question 7Data Protection Principles and Legal Frameworks

Under the GDPR, which principle requires personal data to be accurate and, where necessary, kept up to date, with reasonable steps taken to erase or rectify inaccurate data?

  1. Accuracy Correct answer.
  2. Transparency
  3. Integrity and confidentiality
  4. Accountability

Explanation

The accuracy principle requires data to be correct and current, and requires erasure or rectification of inaccurate data without undue delay. It also requires reasonable steps to ensure accuracy given the purpose.

Question 8Data Protection Principles and Legal Frameworks

A bank holds an outdated address for a customer and continues sending statements there despite being informed of the new address. Which principle is most directly engaged?

  1. Storage limitation
  2. Accuracy Correct answer.
  3. Purpose limitation
  4. Data minimisation

Explanation

Accuracy requires that personal data be kept up to date and that inaccurate data be rectified without undue delay. Continuing to use a known-incorrect address breaches this duty.

Question 9Data Protection Principles and Legal Frameworks

Which principle requires that personal data be processed in a manner that ensures appropriate security, including protection against unauthorised processing and against accidental loss or damage?

  1. Accountability
  2. Accuracy
  3. Lawfulness
  4. Integrity and confidentiality Correct answer.

Explanation

Integrity and confidentiality is the security-focused principle requiring protection against unauthorised or unlawful processing and against accidental loss, destruction or damage. It underpins technical and organisational measures.

Question 10Data Protection Principles and Legal Frameworks

A controller stores personal data on unencrypted laptops and has no access controls. Which GDPR principle is most directly breached?

  1. Purpose limitation
  2. Storage limitation
  3. Accuracy
  4. Integrity and confidentiality Correct answer.

Explanation

Integrity and confidentiality requires appropriate technical and organisational measures to protect data against unauthorised access and loss. Unencrypted devices without access controls fail this security standard.

Question 11Data Protection Principles and Legal Frameworks

Which principle makes the controller responsible for compliance with data protection principles and requires the controller to be able to demonstrate that compliance?

  1. Transparency
  2. Accountability Correct answer.
  3. Fairness
  4. Data minimisation

Explanation

Accountability places responsibility on the controller to comply and to demonstrate compliance through records, policies and other measures. It is the principle that operationalises the others.

Question 12Data Protection Principles and Legal Frameworks

A controller adopts written data protection policies, maintains processing records and conducts periodic audits. Which principle do these activities most directly serve?

  1. Storage limitation
  2. Purpose limitation
  3. Accountability Correct answer.
  4. Accuracy

Explanation

Accountability requires controllers to demonstrate compliance through documentation, policies, audits and similar measures. These activities are the practical expression of accountability.

Question 13Data Protection Principles and Legal Frameworks

Under the GDPR, which lawful basis requires that the data subject has given consent that is freely given, specific, informed and unambiguous?

  1. Contract
  2. Legitimate interests
  3. Consent Correct answer.
  4. Legal obligation

Explanation

Consent is a lawful basis only where it meets the GDPR standard of being freely given, specific, informed and unambiguous, expressed by a clear affirmative action. The other bases do not depend on the data subject's agreement.

Question 14Data Protection Principles and Legal Frameworks

A company pre-ticks a consent box on its sign-up form and treats silence as agreement. Which requirement of valid consent is most directly unmet?

  1. Freely given nature
  2. Unambiguous affirmative indication Correct answer.
  3. Specificity of purpose
  4. Informed nature

Explanation

Valid consent requires a clear affirmative action; pre-ticked boxes and silence do not constitute unambiguous indication of agreement. Specificity, information and freedom are separate requirements.

Question 15Data Protection Principles and Legal Frameworks

Which lawful basis applies where processing is necessary for the performance of a contract to which the data subject is a party?

  1. Consent
  2. Contract Correct answer.
  3. Legitimate interests
  4. Vital interests

Explanation

The contract basis applies where processing is necessary to perform a contract with the data subject or to take pre-contractual steps at their request. Necessity is the key test.

Question 16Data Protection Principles and Legal Frameworks

A hospital processes a patient's data to prevent a serious threat to their life during an emergency. Which lawful basis is most appropriate?

  1. Vital interests Correct answer.
  2. Consent
  3. Contract
  4. Legitimate interests

Explanation

Vital interests applies where processing is necessary to protect someone's life, particularly in emergencies. It is a narrow basis reserved for life-threatening situations.

Question 17Data Protection Principles and Legal Frameworks

Which lawful basis requires a three-part test: a legitimate interest, necessity of processing, and a balancing against the data subject's rights and freedoms?

  1. Legal obligation
  2. Public task
  3. Contract
  4. Legitimate interests Correct answer.

Explanation

Legitimate interests requires identifying a legitimate interest, showing the processing is necessary for it, and balancing it against the data subject's rights and expectations. It is the most flexible but requires documented assessment.

Question 18Data Protection Principles and Legal Frameworks

Which special category of personal data under the GDPR includes information about a person's racial or ethnic origin, political opinions, and religious or philosophical beliefs?

  1. Special categories of personal data Correct answer.
  2. Financial data
  3. Anonymous data
  4. Pseudonymised data

Explanation

The GDPR treats certain sensitive data, including racial or ethnic origin, political opinions, religious or philosophical beliefs, health, sex life and sexual orientation, as special categories requiring additional conditions for processing.

Question 19Data Protection Principles and Legal Frameworks

A clinic wishes to process patient health data for treatment purposes. Which additional requirement applies beyond having a lawful basis under Article 6?

  1. The data must be transferred outside the EU.
  2. A separate condition under Article 9 must be satisfied. Correct answer.
  3. The data must be anonymised before processing.
  4. No additional requirement applies to health data.

Explanation

Processing special category data requires both an Article 6 lawful basis and a separate Article 9 condition, such as provision of health care. This dual requirement is a hallmark of sensitive data regulation.

Question 20Data Protection Principles and Legal Frameworks

Under the GDPR, which right allows a data subject to obtain confirmation as to whether personal data concerning them is being processed and to access that data?

  1. Right to object
  2. Right to erasure
  3. Right to data portability
  4. Right of access Correct answer.

Explanation

The right of access entitles data subjects to confirmation of processing and a copy of their personal data, along with specified information. It is distinct from erasure, portability and objection.

Question 21Data Protection Principles and Legal Frameworks

A data subject asks a controller to delete their personal data because it is no longer necessary for the purpose for which it was collected. Which right are they exercising?

  1. Right to restriction
  2. Right to rectification
  3. Right to portability
  4. Right to erasure Correct answer.

Explanation

The right to erasure, sometimes called the right to be forgotten, allows data subjects to request deletion where grounds such as no longer necessary apply. Rectification, restriction and portability address different entitlements.

Question 22Data Protection Principles and Legal Frameworks

Which right allows a data subject to receive their personal data in a structured, commonly used and machine-readable format and to transmit it to another controller?

  1. Right to data portability Correct answer.
  2. Right to object
  3. Right of access
  4. Right to rectification

Explanation

Data portability provides a right to receive data in a machine-readable format and to transmit it to another controller, subject to conditions such as processing based on consent or contract and carried out by automated means.

Question 23Data Protection Principles and Legal Frameworks

A controller receives a subject access request and cannot immediately identify the requester. What is the most appropriate response consistent with data protection principles?

  1. Disclose all data immediately without verification.
  2. Delete the data to avoid the request.
  3. Refuse the request outright because identity is unconfirmed.
  4. Request additional information to confirm identity before responding. Correct answer.

Explanation

Controllers may request additional information necessary to confirm identity before acting on a request, while still responding within the statutory timeframe. This balances the data subject's access right with security.

Question 24Data Protection Principles and Legal Frameworks

Which concept describes the transfer of personal data to a country outside the EEA where the receiving jurisdiction has not received an adequacy decision, requiring safeguards such as standard contractual clauses?

  1. Pseudonymisation
  2. Data minimisation
  3. International data transfer Correct answer.
  4. Anonymisation

Explanation

International transfers to third countries require a transfer mechanism such as an adequacy decision, standard contractual clauses or another approved safeguard. Pseudonymisation, minimisation and anonymisation are distinct concepts.

Question 25Data Protection Principles and Legal Frameworks

A controller relies on standard contractual clauses to transfer data to a processor in a third country without an adequacy decision. Which additional obligation is most consistent with accountability?

  1. Assess whether the destination's laws undermine the safeguards and adopt supplementary measures if needed. Correct answer.
  2. Obtain consent from every data subject regardless of circumstances.
  3. Anonymise all data before transfer in every case.
  4. Assume the clauses guarantee protection regardless of local law.

Explanation

Where relying on transfer safeguards, controllers must assess whether the destination's legal environment undermines the protection and adopt supplementary measures if necessary. This reflects the accountability principle in transfer governance.

Question 26Data Protection Principles and Legal Frameworks

Which principle requires that personal data be collected for specified, explicit and legitimate purposes and not further processed in a manner incompatible with those purposes?

  1. Data minimisation
  2. Integrity and confidentiality
  3. Storage limitation
  4. Purpose limitation Correct answer.

Explanation

Purpose limitation ensures that data is collected for defined, explicit and legitimate purposes and is not reused for incompatible purposes. Data minimisation concerns the amount of data, storage limitation concerns retention periods, and integrity and confidentiality concerns security.

Question 27Data Protection Principles and Legal Frameworks

Under the GDPR, which principle requires that personal data be adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed?

  1. Accountability
  2. Data minimisation Correct answer.
  3. Lawfulness, fairness and transparency
  4. Accuracy

Explanation

Data minimisation mandates that only data that is adequate, relevant and necessary for the stated purpose be processed. Lawfulness, fairness and transparency concern the legal basis and openness, accuracy concerns correctness, and accountability concerns responsibility for compliance.

Question 28Data Protection Principles and Legal Frameworks

A data subject objects to processing based on legitimate interests and the controller cannot demonstrate compelling legitimate grounds that override the individual's interests. What must the controller do?

  1. Anonymise the data and continue processing
  2. Cease processing the personal data Correct answer.
  3. Continue processing but inform the supervisory authority
  4. Charge a fee to the data subject for continued processing

Explanation

Where an objection is made to processing based on legitimate interests, the controller must stop processing unless it can demonstrate compelling legitimate grounds that override the data subject's interests, rights and freedoms. If it cannot, processing must cease.

Question 29Data Protection Principles and Legal Frameworks

Which right allows a data subject to obtain a copy of their personal data undergoing processing and to receive it in a structured, commonly used and machine-readable format?

  1. Right to erasure
  2. Right to data portability Correct answer.
  3. Right to restriction of processing
  4. Right to rectification

Explanation

The right to data portability enables individuals to receive their personal data in a structured, commonly used and machine-readable format and to transmit it to another controller. Rectification concerns correcting inaccurate data, erasure concerns deletion, and restriction concerns limiting processing.

Question 30Data Protection Principles and Legal Frameworks

A controller discovers that a processor it engaged has subcontracted part of the processing to another organisation without authorisation. Which GDPR obligation has the processor most directly breached?

  1. The obligation not to engage another processor without prior specific or general written authorisation from the controller Correct answer.
  2. The obligation to maintain a record of processing activities
  3. The obligation to assist with data protection impact assessments
  4. The obligation to appoint a data protection officer

Explanation

Under the GDPR, a processor may not engage another processor without prior specific or general written authorisation from the controller. Unauthorised subcontracting directly breaches this condition of the processor's engagement.

Question 31Data Protection Principles and Legal Frameworks

Which lawful basis for processing requires that the data subject has given consent that is freely given, specific, informed and unambiguous?

  1. Consent Correct answer.
  2. Legal obligation
  3. Contract
  4. Vital interests

Explanation

Consent is the lawful basis that requires a freely given, specific, informed and unambiguous indication of the data subject's wishes. Contract, legal obligation and vital interests are separate bases that do not depend on consent.

Question 32Data Protection Principles and Legal Frameworks

A company processes personal data to comply with anti-money-laundering legislation. Which lawful basis is most appropriate?

  1. Legal obligation Correct answer.
  2. Public task
  3. Legitimate interests
  4. Consent

Explanation

Processing necessary to comply with a legal obligation, such as anti-money-laundering law, is based on the legal obligation basis. Consent is inappropriate because the processing is mandated by law, and public task applies to official functions, not private compliance.

Question 33Data Protection Principles and Legal Frameworks

Which of the following is a special category of personal data under the GDPR?

  1. Trade union membership Correct answer.
  2. IP addresses
  3. Financial account numbers
  4. Employment history

Explanation

Special categories include data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data for unique identification, health data, and data concerning sex life or sexual orientation. Financial account numbers, IP addresses and employment history are ordinary personal data.

Question 34Data Protection Principles and Legal Frameworks

A controller wishes to process special category data for a new purpose. In addition to identifying a lawful basis under Article 6, what must the controller identify?

  1. A data protection officer's written approval
  2. A separate condition for processing special category data under Article 9 Correct answer.
  3. Adequacy decision from the European Commission
  4. A binding corporate rules approval

Explanation

Processing special category data requires both a lawful basis under Article 6 and a separate condition under Article 9, such as explicit consent or employment law obligations. A DPO approval, adequacy decision or binding corporate rules are not conditions for lawful processing.

Question 35Data Protection Principles and Legal Frameworks

Which principle requires that personal data be processed in a lawful, fair and transparent manner in relation to the data subject?

  1. Accuracy
  2. Lawfulness, fairness and transparency Correct answer.
  3. Integrity and confidentiality
  4. Storage limitation

Explanation

The lawfulness, fairness and transparency principle requires that processing have a legal basis, be fair to individuals, and be communicated openly. Accuracy concerns correctness, storage limitation concerns retention, and integrity and confidentiality concern security.

Question 36Data Protection Principles and Legal Frameworks

Under the GDPR, what is the maximum period within which a controller must respond to a data subject access request?

  1. 30 days, extendable by a further two months for complex requests Correct answer.
  2. 14 days
  3. 72 hours
  4. 6 months

Explanation

The controller must provide information without undue delay and in any event within one month (30 days) of receipt, which may be extended by two further months where necessary, taking into account the complexity and number of requests. Shorter periods apply to breach notification, not access requests.

Question 37Data Protection Principles and Legal Frameworks

A controller receives a subject access request but is unsure of the requester's identity. What is the most appropriate first step?

  1. Refuse the request outright
  2. Refer the request to the supervisory authority
  3. Request additional information to confirm identity Correct answer.
  4. Provide all data immediately without verification

Explanation

Where the controller has reasonable doubts about the identity of the individual making the request, it may request additional information necessary to confirm identity. Refusing outright is not appropriate, and providing data without verification risks a data breach.

Question 38Data Protection Principles and Legal Frameworks

Which concept describes a transfer mechanism that allows data to flow between members of a corporate group across borders, subject to approval by a supervisory authority?

  1. Adequacy decision
  2. Standard contractual clauses
  3. Certification mechanism
  4. Binding corporate rules Correct answer.

Explanation

Binding corporate rules are internal rules adopted by a multinational group to govern intra-group transfers of personal data to third countries, and they require supervisory authority approval. Standard contractual clauses and certification are alternative transfer tools, while an adequacy decision is made by the European Commission.

Question 39Data Protection Principles and Legal Frameworks

A controller relies on standard contractual clauses to transfer data to a processor in a third country without an adequacy decision. Following the Schrems II judgment, what additional step is required?

  1. Appoint a representative in the third country
  2. Obtain explicit consent from every data subject
  3. Notify the European Commission before each transfer
  4. Conduct a transfer impact assessment to determine whether the destination country's laws undermine the safeguards Correct answer.

Explanation

After Schrems II, controllers using standard contractual clauses must assess whether the legal regime of the destination country ensures essentially equivalent protection and, if not, adopt supplementary measures. Obtaining consent, notifying the Commission, or appointing a representative are not the required additional step.

Question 40Data Protection Principles and Legal Frameworks

A controller processes personal data for a new purpose that is not compatible with the original purpose for which the data was collected. Which principle is most directly engaged?

  1. Purpose limitation Correct answer.
  2. Data minimisation
  3. Accountability
  4. Accuracy

Explanation

Purpose limitation prohibits further processing for purposes that are incompatible with the original purposes unless a legal basis exists. Data minimisation concerns the amount of data, accuracy concerns correctness, and accountability concerns demonstrating compliance.

Question 41Lawful Bases and Consent Management

Under the GDPR, which lawful basis requires the data subject's agreement as its defining condition?

  1. Consent Correct answer.
  2. Legal obligation
  3. Vital interests
  4. Legitimate interests

Explanation

Consent is a lawful basis that depends on the data subject's freely given, specific, informed and unambiguous agreement. The other bases rest on legal or necessity conditions rather than the subject's agreement.

Question 42Lawful Bases and Consent Management

Which lawful basis is most appropriate when processing is necessary to perform a contract with the data subject?

  1. Public task
  2. Consent
  3. Legitimate interests
  4. Contractual necessity Correct answer.

Explanation

Contractual necessity applies where processing is needed to enter into or perform a contract with the data subject. It is distinct from consent because the processing is required for the contract rather than optional.

Question 43Lawful Bases and Consent Management

A controller processes data to comply with a tax reporting statute. Which lawful basis applies?

  1. Legal obligation Correct answer.
  2. Consent
  3. Vital interests
  4. Contractual necessity

Explanation

Legal obligation covers processing necessary to comply with a legal duty to which the controller is subject. Statutory reporting duties are the classic example.

Question 44Lawful Bases and Consent Management

What are the four cumulative elements of valid consent under the GDPR?

  1. Written, signed, dated and filed
  2. Freely given, specific, informed and unambiguous Correct answer.
  3. Explicit, notarized, timed and logged
  4. Verbal, implied, broad and revocable

Explanation

GDPR consent must be freely given, specific, informed and unambiguous, expressed by a clear affirmative action. These four elements are cumulative.

Question 45Lawful Bases and Consent Management

When is 'explicit consent' required rather than ordinary consent?

  1. For any marketing email
  2. For routine payroll processing
  3. For processing special category data or making automated decisions Correct answer.
  4. For storing cookies on a device

Explanation

Explicit consent is required for special category data and for solely automated decisions with legal or significant effects. Ordinary consent suffices for most other processing.

Question 46Lawful Bases and Consent Management

A user is told 'by continuing to browse, you agree to all processing'. Why is this generally invalid consent?

  1. It is not in writing
  2. It is not specific and relies on inaction Correct answer.
  3. It was not signed by the user
  4. It did not offer an incentive

Explanation

Valid consent must be specific and given by a clear affirmative action; silence or continued browsing is not a valid indication. Bundled, non-specific acceptance also fails the specificity test.

Question 47Lawful Bases and Consent Management

Which right allows a data subject to withdraw consent at any time?

  1. Right to rectification
  2. Right to erasure
  3. Right to portability
  4. Right to withdraw consent Correct answer.

Explanation

The GDPR gives data subjects the right to withdraw consent at any time, and withdrawal must be as easy as giving it. Withdrawal does not affect the lawfulness of prior processing.

Question 48Lawful Bases and Consent Management

What must a controller do before relying on legitimate interests as a lawful basis?

  1. Appoint a data protection officer
  2. Obtain explicit consent
  3. Notify the supervisory authority
  4. Conduct a balancing test weighing its interests against the data subject's rights Correct answer.

Explanation

Legitimate interests requires a three-part assessment: a legitimate interest, necessity of processing, and a balancing test against the data subject's rights and freedoms. Consent is not required for this basis.

Question 49Lawful Bases and Consent Management

A company wants to process customer data for a new purpose unrelated to the original collection. What does purpose limitation require?

  1. Automatic deletion of the old data
  2. Only an update to the privacy notice
  3. Nothing, since consent was already given
  4. A new lawful basis or compatibility assessment for the new purpose Correct answer.

Explanation

Purpose limitation requires that data be used only for the purposes for which it was collected unless a new lawful basis applies or the new purpose is compatible. A mere notice update does not create a lawful basis.

Question 50Lawful Bases and Consent Management

Which condition best reflects 'freely given' consent in an employment context?

  1. Consent obtained because refusal could lead to detriment is suspect Correct answer.
  2. Consent is always valid between employer and employee
  3. Consent can be presumed from continued employment
  4. Consent is implied by the employment contract

Explanation

Because of the imbalance of power, consent from employees is suspect where refusal could carry negative consequences. Employers should generally rely on other lawful bases for processing employee data.