I85PREP
⌘ K
DPO study materials
DPO study resources

DPO practice questions

One question at a time. Build your DPO understanding.

First 50 of 199 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Privacy and Data Protection

Under the GDPR, which lawful basis requires the data subject's freely given, specific, informed and unambiguous indication of agreement to processing of their personal data?

  1. Legitimate interests
  2. Legal obligation
  3. Contractual necessity
  4. Consent Correct answer.

Explanation

Consent under the GDPR must be a freely given, specific, informed and unambiguous indication of the data subject's wishes, expressed by a statement or clear affirmative action. The other bases do not depend on the data subject's agreement but on statutory or contractual grounds or a balancing test.

Question 2Privacy and Data Protection

A company collects an email address solely to send a one-off order confirmation for a purchase. Which GDPR principle most directly limits the company from later using that address for unrelated marketing without a new basis?

  1. Integrity and confidentiality
  2. Storage limitation
  3. Accuracy
  4. Purpose limitation Correct answer.

Explanation

Purpose limitation requires personal data to be collected for specified, explicit and legitimate purposes and not further processed in a manner incompatible with those purposes. Using an address collected for order fulfilment for unrelated marketing is a new purpose needing its own lawful basis.

Question 3Privacy and Data Protection

Which term describes the individual about whom personal data relates?

  1. Controller
  2. Supervisory authority
  3. Data subject Correct answer.
  4. Processor

Explanation

The data subject is the identified or identifiable natural person to whom personal data relates. Controllers and processors are organisations or entities that determine or carry out processing, and a supervisory authority is a regulator.

Question 4Privacy and Data Protection

Which of the following is classified as a special category of personal data under the GDPR?

  1. Postal address
  2. Racial or ethnic origin Correct answer.
  3. Purchase history
  4. Job title

Explanation

Special categories include data revealing racial or ethnic origin, political opinions, religious beliefs, health, sex life or sexual orientation, and genetic or biometric data for unique identification. Ordinary identifiers and commercial records are not special category data.

Question 5Privacy and Data Protection

What is the maximum administrative fine the GDPR allows a supervisory authority to impose for the most serious infringements?

  1. 50 million euros flat regardless of turnover
  2. 5 million euros or 1% of worldwide turnover, whichever is higher
  3. 20 million euros or 4% of total worldwide annual turnover, whichever is higher Correct answer.
  4. 10 million euros or 2% of worldwide turnover, whichever is higher

Explanation

For the most serious infringements the GDPR sets a maximum of 20 million euros or 4% of the preceding financial year's total worldwide annual turnover, whichever is higher. The lower tier of 10 million euros or 2% applies to other infringements.

Question 6Privacy and Data Protection

A data subject asks a controller to erase their personal data and no exemption applies. Within what period must the controller generally respond to the request under the GDPR?

  1. Ten working days from receipt of the request
  2. One month, extendable by two further months for complex requests Correct answer.
  3. Seventy-two hours from receipt of the request
  4. Six months, with no possibility of extension

Explanation

Controllers must respond to data subject requests without undue delay and in any event within one month, which may be extended by two further months where requests are complex or numerous. The shorter deadlines belong to breach notification, not data subject requests.

Question 7Privacy and Data Protection

Which role determines the purposes and means of processing personal data?

  1. Recipient
  2. Controller Correct answer.
  3. Processor
  4. Data subject

Explanation

The controller is the natural or legal person, public authority, agency or other body that determines the purposes and means of processing. Processors act on the controller's behalf, while data subjects and recipients are not decision-makers.

Question 8Privacy and Data Protection

Which principle requires that personal data be kept in a form permitting identification of data subjects for no longer than necessary?

  1. Storage limitation Correct answer.
  2. Transparency
  3. Data minimisation
  4. Lawfulness

Explanation

Storage limitation requires that data be kept no longer than is necessary for the purposes for which it is processed. Data minimisation instead concerns collecting only adequate and relevant data.

Question 9Privacy and Data Protection

A retailer wants to send marketing emails to existing customers. Under the ePrivacy framework as commonly implemented in the EU, which approach best reflects the typical rule for soft opt-in marketing?

  1. Marketing to existing customers is always permitted without any opt-out opportunity
  2. Marketing to existing customers is prohibited unless they re-confirm consent annually
  3. Marketing to existing customers is allowed only if they were given a clear chance to opt out at collection and in every message Correct answer.
  4. Marketing to existing customers is permitted only with a signed paper form

Explanation

The soft opt-in exception generally permits direct marketing to existing customers for similar products where they were informed and given a simple opportunity to refuse at collection and in each subsequent message. It does not remove the need for an opt-out mechanism.

Question 10Privacy and Data Protection

An organisation relies on legitimate interests as its lawful basis. Which step is essential to demonstrate compliance?

  1. Registering the processing with the supervisory authority in advance
  2. Carrying out and documenting a balancing test between its interests and the individual's rights Correct answer.
  3. Obtaining written consent from every affected individual
  4. Appointing a data protection officer in every case

Explanation

Legitimate interests requires a three-part assessment: a legitimate interest, necessity of processing, and a balancing of that interest against the individual's rights and freedoms, which should be documented. Consent, prior registration and a DPO are separate requirements not tied to this basis.

Question 11Privacy and Data Protection

A controller discovers a personal data breach that is likely to result in a risk to individuals' rights and freedoms. What must it generally do under the GDPR?

  1. Notify the supervisory authority without undue delay and where feasible within 72 hours of becoming aware Correct answer.
  2. Notify every data subject within 24 hours in all cases
  3. Wait until the annual report to disclose the breach
  4. Publish the breach in a national newspaper

Explanation

A controller must notify the competent supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of a breach likely to result in a risk. Communication to data subjects is required only where the breach is likely to result in a high risk.

Question 12Privacy and Data Protection

Which right allows an individual to receive their personal data in a structured, commonly used and machine-readable format and to transmit it to another controller?

  1. Right to object
  2. Right to rectification
  3. Data portability Correct answer.
  4. Right to restriction

Explanation

The right to data portability lets data subjects receive their data in a structured, commonly used, machine-readable format and transmit it to another controller where processing is based on consent or contract and carried out by automated means. The other rights concern correction, limiting processing, or objecting.

Question 13Privacy and Data Protection

A company engages a cloud vendor that hosts personal data but makes no independent decisions about how it is used. What instrument must govern this relationship under the GDPR?

  1. A unilateral internal policy of the cloud vendor
  2. A written contract between controller and processor setting out processing instructions and obligations Correct answer.
  3. No instrument is needed because the vendor never sees the data
  4. A verbal agreement confirmed by email only

Explanation

Where processing is carried out on behalf of a controller, a written contract or other legal act binding the processor to the controller must set out the subject matter, duration, nature and purpose of processing and the processor's obligations. Verbal or unilateral arrangements do not satisfy this requirement.

Question 14Privacy and Data Protection

Which practice best reflects the principle of data minimisation?

  1. Gathering data for vaguely defined future uses
  2. Collecting only the fields needed for the stated purpose Correct answer.
  3. Retaining all data for ten years in case it is useful later
  4. Collecting extra data because storage is inexpensive

Explanation

Data minimisation requires personal data to be adequate, relevant and limited to what is necessary for the purposes. Collecting extra fields or retaining data speculatively conflicts with this principle.

Question 15Privacy and Data Protection

When must a controller designate a Data Protection Officer under the GDPR?

  1. In every organisation that processes any personal data
  2. Only when a supervisory authority requests it after a complaint
  3. Where core activities involve large-scale regular and systematic monitoring of individuals or large-scale processing of special category data Correct answer.
  4. Only when the organisation exceeds 250 employees

Explanation

A DPO must be designated where processing is carried out by a public authority, where core activities require large-scale regular and systematic monitoring, or where core activities involve large-scale processing of special category or criminal data. It is not a universal requirement tied to headcount.

Question 16Privacy and Data Protection

A controller plans to transfer personal data to a country without an adequacy decision. Which mechanism can it rely on to provide appropriate safeguards?

  1. An internal note stating the transfer is confidential
  2. Standard contractual clauses approved by the European Commission Correct answer.
  3. The data subject's general familiarity with the destination country
  4. A verbal promise from the recipient to be careful

Explanation

In the absence of an adequacy decision, transfers may rely on appropriate safeguards such as standard contractual clauses or binding corporate rules. Informal assurances do not meet the transfer requirements.

Question 17Privacy and Data Protection

Which of the following best describes the GDPR principle of accountability?

  1. The controller must be able to demonstrate compliance with the data protection principles Correct answer.
  2. The controller must delete all data after one year
  3. The controller must publish every processing operation on its website
  4. The controller must obtain consent for all processing

Explanation

Accountability requires the controller to comply with the principles and to be able to demonstrate that compliance, for example through policies, records and assessments. It does not mandate universal consent, public disclosure of every operation, or a fixed retention period.

Question 18Privacy and Data Protection

A data subject objects to processing carried out for direct marketing. What is the controller's obligation?

  1. Stop the marketing processing on request Correct answer.
  2. Refer the objection to the supervisory authority for a decision
  3. Continue until the next scheduled review
  4. Ask the data subject to justify the objection in writing

Explanation

Where personal data is processed for direct marketing, the data subject has an absolute right to object, and the controller must stop that processing. It cannot require justification or defer to the regulator for this decision.

Question 19Privacy and Data Protection

Which of the following is a valid condition for processing special category data under the GDPR?

  1. The data subject has given explicit consent to the processing for specified purposes Correct answer.
  2. The processing is necessary for general business analytics
  3. The controller has a legitimate interest in the data
  4. The data is publicly available on a social network

Explanation

Processing special category data requires one of the listed conditions in addition to a lawful basis, one of which is the data subject's explicit consent. Legitimate interests, mere public availability and general analytics are not among those conditions.

Question 20Privacy and Data Protection

Which record-keeping obligation generally applies to many controllers under the GDPR?

  1. Maintaining records of processing activities Correct answer.
  2. Filing every data subject request with the regulator
  3. Reporting monthly to the supervisory authority
  4. Storing a copy of all personal data with the supervisory authority

Explanation

Controllers must maintain records of processing activities containing specified information, subject to limited exemptions. There is no obligation to file every request, deposit data with the regulator, or report monthly.

Question 21Privacy and Data Protection

A bank wants to use automated decision-making, including profiling, that produces legal effects concerning a customer. Which statement best reflects the GDPR position?

  1. Such decisions are freely permitted provided the bank keeps a record
  2. Such decisions require notification to the supervisory authority before each use
  3. Such decisions are prohibited in all circumstances
  4. Such decisions are permitted only where necessary for a contract, authorised by law, or based on explicit consent, with safeguards for the individual Correct answer.

Explanation

Decisions based solely on automated processing that produce legal or similarly significant effects are permitted only where necessary for entering into or performing a contract, authorised by law, or based on explicit consent, and must include safeguards such as human intervention and the ability to contest. They are neither freely permitted nor absolutely prohibited.

Question 22Privacy and Data Protection

A controller receives a vague request from an individual who has not identified which data they mean. How should the controller proceed under the GDPR?

  1. It must forward the request to the supervisory authority
  2. It must delete all of the individual's data immediately
  3. It may request additional information needed to confirm identity and locate the data, while acting without undue delay Correct answer.
  4. It may refuse all requests that are not perfectly specified

Explanation

Where a controller has reasonable doubts about the identity of the requester it may ask for additional information, and it may seek clarification needed to locate the data, but it must still act without undue delay. Blanket refusal or automatic deletion is not the correct response.

Question 23Privacy and Data Protection

A company processes data under the legitimate interests basis and later receives an objection from an individual based on their particular situation. What is the correct analysis?

  1. The controller must stop unless it demonstrates compelling legitimate grounds that override the individual's interests, rights and freedoms Correct answer.
  2. The controller must convert the processing to consent immediately
  3. The controller must always stop processing regardless of its grounds
  4. The controller may ignore the objection because legitimate interests always prevail

Explanation

For processing based on legitimate interests, an objection based on the individual's particular situation requires the controller to stop unless it can demonstrate compelling legitimate grounds that override those interests. The right is not absolute here, unlike the direct marketing case.

Question 24Privacy and Data Protection

An organisation wants to rely on consent obtained several years ago for ongoing research processing. Which consideration is most relevant to whether that consent remains valid?

  1. Whether the consent still reflects a specific and informed indication given the current processing, with easy withdrawal available Correct answer.
  2. Whether the consent form was printed on paper
  3. Whether the organisation has since grown in size
  4. Whether the data subject still remembers signing it

Explanation

Consent must remain specific, informed and unambiguous for the processing actually carried out, and withdrawal must be as easy as giving consent. Changes in processing or a lack of ongoing transparency can undermine validity; format, company size and memory are not the governing factors.

Question 25Privacy and Data Protection

A controller uses a processor that engages a sub-processor without specific or general written authorisation. What is the compliance problem?

  1. The controller becomes a processor automatically
  2. There is no problem because sub-processors are outside the GDPR
  3. The processor may not engage a sub-processor without the controller's prior authorisation, and flow-down obligations must apply Correct answer.
  4. The sub-processor becomes the sole controller

Explanation

A processor may not engage another processor without prior specific or general written authorisation from the controller, and where authorised, the same data protection obligations must be imposed on the sub-processor. Unauthorised sub-processing is a breach of the processor's obligations.

Question 26Privacy and Data Protection

Under the GDPR, which term describes information relating to an identified or identifiable natural person?

  1. Aggregated statistics
  2. Personal data Correct answer.
  3. Anonymous data
  4. Synthetic data

Explanation

Personal data is defined as any information relating to an identified or identifiable natural person, the data subject. Anonymous data, by contrast, falls outside the GDPR because re-identification is not reasonably possible.

Question 27Privacy and Data Protection

Which GDPR principle requires that personal data be collected for specified, explicit and legitimate purposes and not further processed incompatibly?

  1. Lawfulness, fairness and transparency
  2. Purpose limitation Correct answer.
  3. Storage limitation
  4. Integrity and confidentiality

Explanation

Purpose limitation requires specified, explicit and legitimate purposes at collection and prohibits incompatible further processing. Storage limitation deals with retention periods, while integrity and confidentiality concerns security.

Question 28Privacy and Data Protection

An individual submits a valid access request to a controller. What is the core obligation of the controller?

  1. Restrict all processing while the request is assessed
  2. Provide a copy of the personal data and information about the processing Correct answer.
  3. Transfer the data directly to another provider
  4. Delete the data unless a legal hold applies

Explanation

The right of access entitles the data subject to confirmation of processing, a copy of their personal data and specified information such as purposes and recipients. Deletion, portability and restriction are separate rights with their own conditions.

Question 29Privacy and Data Protection

Which of the following is a lawful basis under the GDPR for processing ordinary personal data?

  1. Registration in a public directory
  2. Performance of a contract with the data subject Correct answer.
  3. Approval by the information security team
  4. Consent of the data subject's employer

Explanation

Article 6 lists lawful bases including performance of a contract, consent, legal obligation, vital interests, public task and legitimate interests. Internal approvals or third-party consent are not among them.

Question 30Privacy and Data Protection

What does the GDPR principle of data accuracy require of a controller?

  1. Verify identity of every data subject annually
  2. Encrypt all stored records at rest
  3. Take every reasonable step to keep data up to date and rectify inaccurate data Correct answer.
  4. Retain original records even after correction requests

Explanation

Accuracy requires personal data to be accurate and, where necessary, kept up to date, with every reasonable step taken to erase or rectify inaccurate data without delay. It does not mandate encryption or annual identity checks.

Question 31Privacy and Data Protection

Which right allows an individual to obtain the erasure of personal data where the data is no longer necessary for the purposes for which it was collected?

  1. Right to object
  2. Right to erasure Correct answer.
  3. Right to rectification
  4. Right to restriction of processing

Explanation

The right to erasure, often called the right to be forgotten, applies where grounds such as the data no longer being necessary are met and no exemption applies. Rectification corrects inaccurate data and restriction temporarily limits processing.

Question 32Privacy and Data Protection

Which concept describes processing that cannot reasonably be used to identify an individual because the data has been stripped of identifying elements and re-identification is not reasonably likely?

  1. Pseudonymisation
  2. Tokenisation
  3. Anonymisation Correct answer.
  4. Encryption

Explanation

Anonymisation produces data that no longer relates to an identifiable person, placing it outside the GDPR. Pseudonymisation, encryption and tokenisation still allow re-identification with additional information and remain personal data.

Question 33Privacy and Data Protection

Under the GDPR, who is the natural or legal person that determines the purposes and means of processing personal data?

  1. The recipient
  2. The data subject
  3. The supervisory authority
  4. The controller Correct answer.

Explanation

The controller determines the purposes and means of processing. A processor acts on the controller's behalf, the data subject is the individual, and a recipient merely receives data.

Question 34Privacy and Data Protection

A marketing team wants to profile website visitors to predict their interests. Which GDPR principle most directly requires them to limit collection to what is necessary for that stated purpose?

  1. Storage limitation
  2. Data minimisation Correct answer.
  3. Accountability
  4. Integrity and confidentiality

Explanation

Data minimisation requires personal data to be adequate, relevant and limited to what is necessary for the purposes. Accountability concerns demonstrating compliance, while storage limitation concerns retention periods.

Question 35Privacy and Data Protection

A controller wants to process biometric data to control physical access to a facility. Which statement about this processing is correct?

  1. Biometric data requires only a processor agreement
  2. Biometric data used for unique identification is special category data requiring an Article 9 condition Correct answer.
  3. Biometric data is ordinary personal data, so Article 6 alone suffices
  4. Biometric data may never be processed under the GDPR

Explanation

Biometric data processed for the purpose of uniquely identifying a person is special category data, so an Article 9 condition in addition to an Article 6 basis is required. It is not prohibited outright, and a processor agreement alone is insufficient.

Question 36Privacy and Data Protection

A controller based in the EU uses a processor located outside the EU that will access personal data. Which step is most appropriate before the transfer?

  1. Notify the data subjects after the transfer begins
  2. Obtain consent from the processor's employees
  3. Rely on the processor's internal policy alone
  4. Put in place a valid transfer mechanism such as standard contractual clauses plus a transfer impact assessment Correct answer.

Explanation

Transfers outside the EEA require an adequacy decision or appropriate safeguards such as standard contractual clauses, supported by an assessment of the destination's legal environment. Internal policies or late notification do not satisfy the transfer rules.

Question 37Privacy and Data Protection

A controller engages a processor to handle payroll data. Which obligation must the controller ensure is reflected in the written contract?

  1. The processor may set its own retention periods
  2. The processor may share data freely with affiliates
  3. The processor processes only on documented instructions from the controller Correct answer.
  4. The processor becomes the controller for payroll purposes

Explanation

A controller-processor contract must require the processor to process only on documented instructions from the controller and to meet other Article 28 obligations. The processor cannot become a controller or set its own purposes under that contract.

Question 38Privacy and Data Protection

A company wants to rely on legitimate interests for a new analytics feature. Which action best supports that basis?

  1. Encrypt the analytics database
  2. Add a clause to the privacy notice stating that legitimate interests apply
  3. Obtain a processor agreement with the analytics vendor
  4. Record a legitimate interests assessment balancing the interest against individuals' rights Correct answer.

Explanation

Relying on legitimate interests requires a three-part assessment: a legitimate interest, necessity of the processing, and a balancing test against individuals' rights and expectations. Documentation of that assessment demonstrates accountability.

Question 39Privacy and Data Protection

A data subject requests a copy of their data in a portable format. Which condition must generally be met for the right to data portability to apply?

  1. The controller must be a public authority
  2. The processing must be based on consent or contract and carried out by automated means Correct answer.
  3. The data must include special category information
  4. The data must have been collected more than five years ago

Explanation

Portability applies to data provided by the data subject where processing is based on consent or contract and is carried out by automated means. It does not depend on the age of the data, the type of controller or the sensitivity of the data.

Question 40Privacy and Data Protection

A controller receives a request from a data subject to exercise a right. Within what period must the controller generally respond, and may this be extended?

  1. Within one month, extendable by two further months for complex requests with notice Correct answer.
  2. Within 24 hours, extendable by one month
  3. Within 72 hours, with no possibility of extension
  4. Within three months, with no possibility of extension

Explanation

Controllers must respond without undue delay and in any event within one month, which may be extended by two further months where requests are complex or numerous, provided the data subject is informed of the extension.

Question 41Privacy and Data Protection

A controller plans to use CCTV to monitor a public entrance. Which consideration is most relevant under the GDPR?

  1. A lawful basis, clear notice and necessity assessment are required, with proportionality of coverage Correct answer.
  2. Only the police may operate CCTV
  3. The data subjects must sign individual consent forms at the entrance
  4. CCTV is always prohibited in public areas

Explanation

CCTV processing requires a lawful basis, transparency through signage and a necessity and proportionality assessment. It is not prohibited, not restricted to police, and consent is rarely the appropriate basis for public-area monitoring.

Question 42Privacy and Data Protection

An organisation processes data to comply with anti-money-laundering legislation. Which lawful basis is most appropriate?

  1. Consent
  2. Vital interests
  3. Compliance with a legal obligation Correct answer.
  4. Legitimate interests

Explanation

Where processing is required to meet a legal obligation to which the controller is subject, compliance with a legal obligation is the appropriate basis. Consent would not be appropriate because the processing is mandatory.

Question 43Privacy and Data Protection

A company wants to send promotional text messages to new prospects. Under the ePrivacy framework as commonly implemented in the EU, what is generally required?

  1. A legitimate interests assessment only
  2. Prior opt-in consent, subject to limited exceptions Correct answer.
  3. A processor agreement with the messaging provider
  4. Notification to the supervisory authority before sending

Explanation

Electronic marketing to individuals generally requires prior consent under the ePrivacy rules, subject to narrow exceptions such as existing customer relationships for similar products. Legitimate interests alone does not displace the consent requirement.

Question 44Privacy and Data Protection

A controller wants to carry out a large-scale systematic monitoring of a public area. Which GDPR mechanism is most likely required before processing begins?

  1. A data portability request
  2. A data protection impact assessment Correct answer.
  3. A processor agreement with each data subject
  4. An annual audit by the supervisory authority

Explanation

Large-scale systematic monitoring of publicly accessible areas is a high-risk processing activity that triggers the requirement for a data protection impact assessment. A DPIA helps identify and mitigate risks before processing starts.

Question 45Privacy and Data Protection

Which statement best describes the role of a Data Protection Officer under the GDPR?

  1. The DPO represents data subjects in litigation
  2. The DPO acts as the sole decision-maker on data breaches
  3. The DPO monitors compliance and advises the controller independently Correct answer.
  4. The DPO determines the purposes of processing

Explanation

The DPO informs and advises the controller, monitors compliance and cooperates with the supervisory authority, acting independently and without instructions on DPO tasks. The DPO does not determine purposes or make sole breach decisions.

Question 46Privacy and Data Protection

A controller plans to transfer personal data to a country covered by an adequacy decision. What is the effect of that decision?

  1. Adequacy requires a DPIA for every transfer
  2. Adequacy removes the need for further transfer safeguards for that destination Correct answer.
  3. Adequacy applies only to transfers between public authorities
  4. Adequacy replaces the need for any lawful basis for processing

Explanation

An adequacy decision recognises that a third country provides an adequate level of protection, so transfers may proceed without additional safeguards. It does not remove the need for a lawful basis or apply only to public authorities.

Question 47Privacy and Data Protection

A controller receives a request to erase data that it is legally required to retain under tax law. What is the most appropriate response?

  1. Erase the data immediately because erasure requests always prevail
  2. Transfer the data to the data subject and delete its own copy
  3. Suspend all processing of the data indefinitely without explanation
  4. Refuse the request and explain the legal retention obligation Correct answer.

Explanation

The right to erasure does not apply where processing is necessary for compliance with a legal obligation, such as tax retention duties. The controller should refuse that aspect of the request and inform the data subject of the reason.

Question 48Privacy and Data Protection

An organisation processes employee data for HR administration. Which statement about the relationship between the employing entity and its payroll provider is correct?

  1. The employer is the controller and the payroll provider is a processor Correct answer.
  2. Both are joint controllers for all HR processing
  3. Neither party has GDPR obligations for employee data
  4. The payroll provider is the controller and the employer is a processor

Explanation

The employer determines the purposes and means of HR processing and is therefore the controller, while the payroll provider acting on its instructions is a processor. Joint controllership arises only where both parties determine purposes and means together.

Question 49Privacy and Data Protection

A research institute wants to reuse previously collected data for a new study. Which analysis best determines whether the reuse is compatible with the original purpose?

  1. Reuse is permitted only if the data is anonymised first
  2. Compatibility considers factors such as the link between purposes, context, data nature, consequences and safeguards Correct answer.
  3. Reuse is prohibited unless every data subject gives fresh consent
  4. Reuse is always permitted because research is a legitimate interest

Explanation

Further processing is assessed against criteria including the link between the original and new purposes, the context of collection, the nature of the data, possible consequences and safeguards. Fresh consent is one route but not the only one, and anonymisation is not a precondition.

Question 50Privacy and Data Protection

A controller discovers that a processor has suffered a breach affecting personal data. Which statement best reflects the allocation of responsibilities?

  1. The controller has no obligations because the breach occurred at the processor
  2. The processor must notify affected individuals before informing the controller
  3. The processor must notify the controller without undue delay, and the controller assesses whether to notify the authority Correct answer.
  4. The processor must notify the supervisory authority directly in all cases

Explanation

A processor must notify the controller without undue delay after becoming aware of a breach. The controller then assesses the risk and decides whether to notify the supervisory authority or affected individuals.