I85PREP
⌘ K
PECB CDPO study materials
PECB CDPO study resources

PECB CDPO practice questions

One question at a time. Build your PECB CDPO understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Data protection fundamentals and legal frameworks

Under the GDPR, which role decides the purposes and means of processing personal data?

  1. The data subject
  2. The controller Correct answer.
  3. The processor
  4. The supervisory authority

Explanation

The controller is the natural or legal person, public authority, agency or other body that determines the purposes and means of the processing of personal data. The processor only processes on the controller's behalf, while the supervisory authority oversees compliance and the data subject is the individual concerned.

Question 2Data protection fundamentals and legal frameworks

Which principle requires that personal data be collected for specified, explicit and legitimate purposes and not further processed incompatibly?

  1. Lawfulness and fairness
  2. Storage limitation
  3. Integrity and confidentiality
  4. Purpose limitation Correct answer.

Explanation

Purpose limitation is the principle that data must be collected for specified, explicit and legitimate purposes and not further processed in a manner incompatible with those purposes. It is distinct from rules on retention periods, security, and lawful basis, which address different aspects of processing.

Question 3Data protection fundamentals and legal frameworks

A company retains customer records indefinitely because storage is cheap. Which data protection principle does this most directly violate?

  1. Transparency
  2. Data minimisation
  3. Storage limitation Correct answer.
  4. Accuracy

Explanation

Storage limitation requires that personal data be kept in a form permitting identification for no longer than is necessary for the purposes. Indefinite retention without a justified period contradicts this principle, even if the data is accurate and the processing is disclosed.

Question 4Data protection fundamentals and legal frameworks

Which legal concept describes the individual's ability to control how information about them is collected, used and shared?

  1. Pseudonymisation
  2. Data portability
  3. Accountability
  4. Informational self-determination Correct answer.

Explanation

Informational self-determination is the concept that individuals should be able to control the disclosure and use of their personal information. It underpins many data protection rights, while portability, accountability and pseudonymisation are specific mechanisms or obligations.

Question 5Data protection fundamentals and legal frameworks

Which of the following is sensitive (special category) personal data under the GDPR?

  1. A company's registration number
  2. A person's business email address
  3. Trade union membership Correct answer.
  4. A delivery address

Explanation

Special categories include data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data for unique identification, health data, and data concerning sex life or sexual orientation. Ordinary contact and business identifiers do not fall into these categories.

Question 6Data protection fundamentals and legal frameworks

What is the primary purpose of a data protection impact assessment (DPIA)?

  1. To identify and mitigate risks to individuals from high-risk processing Correct answer.
  2. To certify a product as fully compliant with all laws
  3. To calculate the commercial value of a customer database
  4. To replace the need for a lawful basis for processing

Explanation

A DPIA is a process to describe the processing, assess its necessity and proportionality, and identify and mitigate risks to the rights and freedoms of individuals. It supports accountability for high-risk processing but does not replace a lawful basis or confer certification.

Question 7Data protection fundamentals and legal frameworks

Which international instrument, adopted in 1980, set out foundational fair information principles that influenced later data protection laws?

  1. The Vienna Convention
  2. The OECD Privacy Guidelines Correct answer.
  3. The Berne Convention
  4. The Budapest Convention

Explanation

The OECD Guidelines on the Protection of Privacy and Transborder Flows of Personal Data (1980) articulated principles such as collection limitation, purpose specification and accountability. These principles strongly influenced subsequent national and regional data protection regimes.

Question 8Data protection fundamentals and legal frameworks

Which term describes the transfer of personal data to a country outside the jurisdiction whose law governs the processing?

  1. Data localisation
  2. Cross-border data transfer Correct answer.
  3. Data minimisation
  4. Data subject access

Explanation

Cross-border data transfer refers to moving personal data to another country or international organisation, which typically triggers additional legal safeguards. Localisation is the opposite policy of keeping data within borders, while access and minimisation concern other obligations.

Question 9Data protection fundamentals and legal frameworks

A retailer wants to use existing customer purchase data for a new loyalty scheme. Which analysis is most relevant to determine if this further processing is permitted?

  1. Whether the database is stored in the cloud
  2. Whether the company holds a trademark for the scheme
  3. Whether the new purpose is compatible with the original purpose of collection Correct answer.
  4. Whether the marketing team prefers the scheme

Explanation

Under the purpose limitation principle, further processing must not be incompatible with the purposes for which data was originally collected. The controller assesses factors such as the link between purposes, the context of collection and the nature of the data, rather than infrastructure or branding considerations.

Question 10Data protection fundamentals and legal frameworks

Which lawful basis under the GDPR is most appropriate when a bank must process data to comply with anti-money-laundering legislation?

  1. Legal obligation Correct answer.
  2. Consent
  3. Legitimate interests
  4. Vital interests

Explanation

Where processing is necessary to comply with a legal obligation to which the controller is subject, legal obligation is the appropriate basis. Consent must be freely given and withdrawable and is unsuitable where the law mandates the processing.

Question 11Data protection fundamentals and legal frameworks

A hospital processes patient health records for treatment. Which special category condition most naturally applies?

  1. Explicit consent in all cases
  2. Provision of health care and treatment Correct answer.
  3. Legitimate interests of the hospital
  4. Performance of a contract with a supplier

Explanation

Processing of health data is permitted where it is necessary for the provision of health or social care, treatment, or management of health systems under professional secrecy obligations. Consent is one possible condition but is not required in every treatment context, and legitimate interests cannot legitimise special category data on their own.

Question 12Data protection fundamentals and legal frameworks

Which right allows a data subject to receive their personal data in a structured, commonly used and machine-readable format?

  1. Right to restriction of processing
  2. Right to rectification
  3. Right to data portability Correct answer.
  4. Right to erasure

Explanation

The right to data portability entitles data subjects to receive data they provided in a structured, commonly used and machine-readable format and to transmit it to another controller. Rectification, erasure and restriction address correction, deletion and limiting use respectively.

Question 13Data protection fundamentals and legal frameworks

A controller receives an erasure request but is legally required to retain the records for tax purposes. What is the correct outcome?

  1. The erasure right does not apply to the extent retention is required by law Correct answer.
  2. The controller must delete the data and ignore the tax obligation
  3. The request must be refused entirely with no explanation
  4. The controller must transfer the data to the supervisory authority

Explanation

The right to erasure is not absolute and does not apply where processing is necessary for compliance with a legal obligation, such as tax record-keeping. The controller should inform the data subject of the reasons for refusal, but the underlying retention duty prevails.

Question 14Data protection fundamentals and legal frameworks

Which statement best describes the role of a data protection officer (DPO)?

  1. To sell personal data to third parties
  2. To represent data subjects in court litigation
  3. To act as the sole decision-maker on marketing strategy
  4. To independently monitor compliance and advise the controller or processor Correct answer.

Explanation

A DPO informs and advises the organisation, monitors compliance, and cooperates with the supervisory authority, acting with independence. The DPO does not determine business strategy, sell data or act as legal counsel for data subjects.

Question 15Data protection fundamentals and legal frameworks

Which concept requires a controller to demonstrate that its processing activities comply with data protection law, not merely to comply in practice?

  1. Subsidiarity
  2. Accountability Correct answer.
  3. Proportionality
  4. Neutrality

Explanation

Accountability requires controllers to be able to demonstrate compliance, for example through policies, records of processing and assessments. Proportionality concerns balancing measures against aims, while subsidiarity and neutrality are unrelated governance concepts.

Question 16Data protection fundamentals and legal frameworks

A company transfers personal data to a processor in another country without any transfer mechanism. Which is the most significant legal concern?

  1. The processor may charge higher fees
  2. The processor may use a different software platform
  3. The data may be stored on servers with slower performance
  4. The transfer may lack an adequate safeguard required by the law Correct answer.

Explanation

Cross-border transfers generally require a legal transfer mechanism, such as an adequacy decision or appropriate safeguards, to protect data subjects. Software, performance and pricing are commercial matters rather than the core legal issue.

Question 17Data protection fundamentals and legal frameworks

Which of the following best illustrates the principle of data minimisation?

  1. Collecting every field available in case it is useful later
  2. Sharing data broadly with partners for potential marketing
  3. Collecting only the fields needed to fulfil the stated purpose Correct answer.
  4. Retaining all data for ten years by default

Explanation

Data minimisation requires that personal data be adequate, relevant and limited to what is necessary in relation to the purposes. Collecting only required fields reflects this, whereas broad collection, long default retention and indiscriminate sharing conflict with minimisation and related principles.

Question 18Data protection fundamentals and legal frameworks

What distinguishes pseudonymisation from anonymisation?

  1. Anonymisation requires consent while pseudonymisation does not
  2. Pseudonymisation permanently destroys all identifiers
  3. Pseudonymised data can still be attributed to an individual with additional information, while anonymised data cannot Correct answer.
  4. Pseudonymisation is only used for health data

Explanation

Pseudonymisation replaces identifiers so data cannot be attributed to an individual without additional information kept separately, meaning the data remains personal data. Anonymisation irreversibly removes identifiability so the data falls outside data protection law.

Question 19Data protection fundamentals and legal frameworks

Which regional framework is widely recognised for harmonising data protection across European countries and influencing global law?

  1. The General Data Protection Regulation Correct answer.
  2. The Basel Accords
  3. The Hague Convention on Apostilles
  4. The Uniform Commercial Code

Explanation

The GDPR established a comprehensive, harmonised data protection regime across the EU and has influenced legislation worldwide. The other instruments concern commercial law, banking supervision and authentication of documents, not privacy.

Question 20Data protection fundamentals and legal frameworks

A marketing team plans to rely on pre-ticked boxes to obtain consent for email marketing. Why is this problematic?

  1. Pre-ticked boxes are valid only for business customers
  2. Pre-ticked boxes are acceptable if the font is large enough
  3. Pre-ticked boxes do not constitute valid consent because consent requires an affirmative action Correct answer.
  4. Pre-ticked boxes satisfy the legitimate interests basis

Explanation

Valid consent must be freely given, specific, informed and unambiguous, expressed by a clear affirmative action. Pre-ticked boxes or silence do not demonstrate such an action, so they cannot serve as valid consent regardless of presentation or audience.

Question 21Data protection fundamentals and legal frameworks

Which obligation applies to a processor under the GDPR when engaging a sub-processor?

  1. It needs the controller's prior authorisation and must impose equivalent data protection obligations Correct answer.
  2. It may appoint any sub-processor without informing the controller
  3. It must notify the supervisory authority before every appointment
  4. It must transfer all data to the sub-processor permanently

Explanation

A processor may engage a sub-processor only with the controller's prior specific or general written authorisation and must flow down equivalent data protection obligations by contract. Notification to the regulator is not required for each appointment, and permanent transfer is not implied.

Question 22Data protection fundamentals and legal frameworks

A controller wants to rely on legitimate interests for a new profiling activity. Which step is essential to that reliance?

  1. Obtaining explicit consent from every data subject
  2. Conducting a balancing test and offering an easy right to object Correct answer.
  3. Registering the activity with the supervisory authority
  4. Ensuring the data is anonymised before processing

Explanation

Relying on legitimate interests requires a three-part assessment: a legitimate interest, necessity of the processing, and a balancing test against individuals' rights, with the right to object respected. Consent would be an alternative basis, and registration or prior anonymisation are not prerequisites.

Question 23Data protection fundamentals and legal frameworks

Why does the distinction between a controller and a processor matter for liability?

  1. Both roles carry identical obligations in every respect
  2. Liability always falls on the data subject
  3. The controller bears primary responsibility for compliance, while processors face specific obligations for their part Correct answer.
  4. Only processors can be held liable for unlawful processing

Explanation

The controller is primarily responsible for compliance and for demonstrating it, while processors have defined duties such as acting on instructions, ensuring security and assisting the controller. Liability can attach to each for breaches of their respective obligations, so the roles are not identical and do not shift responsibility to data subjects.

Question 24Data protection fundamentals and legal frameworks

An organisation plans processing likely to result in a high risk to individuals' rights. What does the law generally require before processing begins?

  1. Approval from every data subject by notarised letter
  2. Publication of the processing in a national newspaper
  3. Immediate deletion of all existing data
  4. A data protection impact assessment, and consultation with the supervisory authority if residual risk remains high Correct answer.

Explanation

High-risk processing requires a DPIA before it starts, and where the assessment indicates residual high risk that cannot be mitigated, the controller must consult the supervisory authority. The other options are not legal requirements and would not address the risk assessment obligation.

Question 25Data protection fundamentals and legal frameworks

A controller relies on consent, but a data subject later withdraws it. What is the correct legal position?

  1. Withdrawal converts the basis automatically to legitimate interests
  2. Withdrawal requires a court order to take effect
  3. Withdrawal must be as easy as giving consent, and processing based on consent must stop Correct answer.
  4. Withdrawal is ineffective once processing has started

Explanation

Consent must be withdrawable at any time, and withdrawal must be as easy as giving it. Once withdrawn, processing that relied on consent must cease, although processing carried out before withdrawal remains lawful and other lawful bases are not created automatically.

Question 26Data protection fundamentals and legal frameworks

Which term describes the individual about whom personal data is collected and processed?

  1. Data subject Correct answer.
  2. Joint controller
  3. Data controller
  4. Supervisory authority

Explanation

The data subject is the identified or identifiable natural person to whom the personal data relates. The controller determines purposes and means of processing, the supervisory authority regulates, and a joint controller shares decision-making with another controller.

Question 27Data protection fundamentals and legal frameworks

Which term covers any information relating to an identified or identifiable natural person?

  1. Personal data Correct answer.
  2. Trade secret
  3. Aggregated statistics
  4. Metadata

Explanation

Personal data is defined by its relationship to an identifiable person, whether identified directly or indirectly by identifiers such as names, numbers, or location data. Aggregated statistics and metadata may fall inside or outside the definition depending on whether they can be linked back to a person.

Question 28Data protection fundamentals and legal frameworks

A dataset contains only the year of birth, city, and job title of residents in a small town. Which statement best characterises its status under data protection law?

  1. It is anonymous because no names are recorded
  2. It is only personal data if it is stored electronically
  3. It is special category data because it reveals health
  4. It may still be personal data because the combination can single out individuals Correct answer.

Explanation

Identifiability is assessed from the means reasonably likely to be used by the controller or another person, so combining indirect identifiers can make data personal even without names. Anonymity requires that individuals can no longer be identified by any reasonably likely means.

Question 29Data protection fundamentals and legal frameworks

Which principle requires that personal data be collected for specified, explicit, and legitimate purposes and not further processed incompatibly?

  1. Purpose limitation Correct answer.
  2. Accuracy
  3. Storage limitation
  4. Integrity and confidentiality

Explanation

Purpose limitation governs why data is collected and restricts later reuse to compatible purposes or a separate legal basis. Storage limitation concerns retention periods, integrity and confidentiality concerns security, and accuracy concerns correctness of the data.

Question 30Data protection fundamentals and legal frameworks

Under the GDPR, which principle requires that personal data be kept no longer than necessary for the purposes for which it is processed?

  1. Accountability
  2. Lawfulness and fairness
  3. Storage limitation Correct answer.
  4. Data minimisation

Explanation

Storage limitation addresses retention duration and requires defined retention periods or criteria. Data minimisation concerns the amount and scope of data collected, while accountability concerns demonstrating compliance.

Question 31Data protection fundamentals and legal frameworks

Which concept describes processing that cannot reasonably be attributed to a specific data subject without additional information kept separately and protected?

  1. Pseudonymisation Correct answer.
  2. Anonymisation
  3. Encryption
  4. Redaction

Explanation

Pseudonymisation replaces direct identifiers so that data can no longer be attributed to a person without additional information held separately and secured. The data remains personal data because re-attribution remains possible.

Question 32Data protection fundamentals and legal frameworks

Which statement correctly distinguishes anonymisation from pseudonymisation?

  1. Both techniques remove data from the scope of data protection law
  2. Anonymised data remains personal data, whereas pseudonymised data does not
  3. Anonymisation requires a key held by the controller, whereas pseudonymisation does not
  4. Pseudonymised data remains personal data, whereas properly anonymised data falls outside the law Correct answer.

Explanation

Pseudonymised data can still be linked to a person via separately held additional information, so it remains personal data and the law applies. Anonymisation must be irreversible in practice, taking the data outside the material scope of data protection law.

Question 33Data protection fundamentals and legal frameworks

Which regional instrument, adopted in 2016 and applicable from 2018, established a comprehensive data protection framework for the European Union?

  1. The ASEAN Data Management Framework
  2. The Convention 108 modernised protocol
  3. The OECD Privacy Guidelines
  4. The General Data Protection Regulation Correct answer.

Explanation

The GDPR was adopted in 2016 and became applicable on 25 May 2018, replacing the 1995 Data Protection Directive. It is the central EU regulation and has influenced many national laws worldwide.

Question 34Data protection fundamentals and legal frameworks

Which body is primarily responsible for enforcing the GDPR in a member state and handling complaints from individuals?

  1. The European Commission
  2. The national supervisory authority Correct answer.
  3. The controller's data protection officer
  4. The European Data Protection Board

Explanation

Each member state designates one or more independent supervisory authorities that enforce the GDPR domestically, investigate complaints, and can impose fines. The European Data Protection Board coordinates consistency, and the Commission has no direct enforcement role over controllers.

Question 35Data protection fundamentals and legal frameworks

What is the primary role of Convention 108 of the Council of Europe in the development of data protection law?

  1. It was the first international treaty establishing data protection principles for automated processing Correct answer.
  2. It harmonised marketing consent rules across the EU
  3. It created the European Data Protection Board
  4. It set binding global fines for data breaches

Explanation

Convention 108, opened for signature in 1981, was the first legally binding international instrument protecting individuals against abuses in automatic processing of personal data. Its principles influenced later national and regional frameworks.

Question 36Data protection fundamentals and legal frameworks

A controller in France processes data about customers located in Germany. Which supervisory authority is the lead authority under the GDPR one-stop-shop mechanism?

  1. The French authority where the controller has its main establishment Correct answer.
  2. The authority of the member state where the server is hosted
  3. The German authority where the customers live
  4. The European Data Protection Board

Explanation

For cross-border processing, the lead supervisory authority is generally that of the member state where the controller's main establishment in the EU is located. Customer location and server location do not determine the lead authority.

Question 37Data protection fundamentals and legal frameworks

Which statement best describes the material scope of the GDPR?

  1. It applies only to processing carried out by public authorities
  2. It applies only to processing of data collected with consent
  3. It applies to processing of personal data wholly or partly by automated means and to manual processing held in filing systems Correct answer.
  4. It applies to all processing of personal data by any entity worldwide without exception

Explanation

The GDPR covers automated processing of personal data and non-automated processing where data form part of a filing system, subject to specific exclusions such as purely personal or household activity. It is not limited to public bodies or to consent-based processing.

Question 38Data protection fundamentals and legal frameworks

An EU company offers a free newsletter to users in Brazil and monitors their browsing behaviour to personalise content. Which factor is most relevant to whether the GDPR applies?

  1. The nationality of the company's shareholders
  2. Whether the individuals have signed a paper form
  3. Whether the processing is carried out in the context of the activities of the company's EU establishment Correct answer.
  4. Whether the data is stored on EU servers

Explanation

Article 3(1) applies to processing in the context of an EU establishment's activities, even when individuals are in Brazil or processing occurs elsewhere. Assuming the newsletter forms part of those activities, the establishment connection is decisive. EU targeting or monitoring under Article 3(2) is a separate route for controllers or processors not established in the EU.

Question 39Data protection fundamentals and legal frameworks

Which lawful basis is most appropriate when a controller processes personal data because a court order requires disclosure?

  1. Compliance with a legal obligation Correct answer.
  2. Consent
  3. Legitimate interests
  4. Performance of a contract

Explanation

Where processing is necessary to comply with a legal obligation to which the controller is subject, that basis applies. Consent would be inappropriate and revocable, and legitimate interests cannot override a clear statutory duty.

Question 40Data protection fundamentals and legal frameworks

What does the principle of fairness add to the requirement of lawfulness in data processing?

  1. It requires that data be deleted after one year
  2. It requires that all data be stored within the EU
  3. It requires that processing always be based on consent
  4. It requires that processing be transparent and not use data in ways that unjustifiably disadvantage individuals Correct answer.

Explanation

Fairness goes beyond having a legal basis and requires transparent, balanced processing that does not misuse data or produce unjustified adverse effects on individuals. It does not impose localisation, mandatory consent, or a fixed retention period.

Question 41Data protection fundamentals and legal frameworks

Which right allows an individual to obtain confirmation of whether their personal data is being processed and to access that data?

  1. Right to object
  2. Right to restriction
  3. Right of access Correct answer.
  4. Right to rectification

Explanation

The right of access entitles the data subject to confirmation of processing and a copy of the personal data, together with information about purposes and recipients. Rectification corrects inaccurate data, objection stops certain processing, and restriction limits it.

Question 42Data protection fundamentals and legal frameworks

A data subject asks for a copy of their data and information about the purposes of processing and the recipients. Which obligation does this trigger for the controller?

  1. To refuse because the request is too broad
  2. To charge a standard fee in every case
  3. To respond within the statutory period, normally one month, providing the requested information Correct answer.
  4. To erase all data immediately

Explanation

Access requests must be answered without undue delay and in principle within one month, extendable for complex cases, and generally free of charge. The controller must provide the data and specified information such as purposes and recipients.

Question 43Data protection fundamentals and legal frameworks

Which statement best describes the accountability principle?

  1. The controller must be able to demonstrate compliance with data protection principles Correct answer.
  2. The controller must appoint a data protection officer in all cases
  3. The controller must notify every processing activity to the supervisory authority in advance
  4. The controller must obtain consent for every processing operation

Explanation

Accountability requires the controller to take appropriate measures and to be able to demonstrate that processing complies with the regulation, for example through records, policies, and assessments. It does not require universal prior notification, universal DPO appointment, or consent for all processing.

Question 44Data protection fundamentals and legal frameworks

Which of the following best illustrates the principle of data minimisation in practice?

  1. Collecting every field that might be useful later in case it becomes relevant
  2. Retaining all data indefinitely to support future analytics
  3. Sharing data with all partners to increase transparency
  4. Collecting only the fields needed to fulfil the stated purpose Correct answer.

Explanation

Data minimisation requires that data be adequate, relevant, and limited to what is necessary for the purposes. Collecting speculative fields or retaining everything indefinitely exceeds what is necessary.

Question 45Data protection fundamentals and legal frameworks

An organisation wants to rely on legitimate interests for a new profiling activity. Which element is essential to that reliance?

  1. Conducting and documenting a balancing test against individuals' rights and expectations Correct answer.
  2. Obtaining explicit consent from every affected individual
  3. Transferring the data outside the EU
  4. Appointing a supervisory authority representative

Explanation

The legitimate interests basis requires a three-part assessment: a legitimate interest, necessity of the processing, and a balancing exercise showing that individuals' rights and freedoms do not override it. This assessment should be documented as part of accountability.

Question 46Data protection fundamentals and legal frameworks

Which condition must generally be satisfied for consent to be valid under the GDPR?

  1. It must be renewed every month
  2. It must be bundled with the terms of service
  3. It must be freely given, specific, informed, and unambiguous Correct answer.
  4. It must be given in writing and notarised

Explanation

Valid consent requires a freely given, specific, informed, and unambiguous indication of the data subject's wishes, expressed by a statement or clear affirmative action. Bundled or vague consent fails these conditions.

Question 47Data protection fundamentals and legal frameworks

A company uses pre-ticked boxes on its website to obtain consent for marketing emails. Why is this approach generally invalid?

  1. Because consent must be given by a clear affirmative action rather than assumed from inaction Correct answer.
  2. Because marketing emails are always prohibited
  3. Because pre-ticked boxes are only valid for special category data
  4. Because consent must be obtained by a public authority

Explanation

Consent requires an unambiguous indication of wishes by a clear affirmative act; silence, pre-ticked boxes, or inactivity do not constitute valid consent. The controller must be able to demonstrate that consent was given.

Question 48Data protection fundamentals and legal frameworks

Which statement correctly describes the relationship between a controller and a processor?

  1. The processor and controller are always jointly liable for the same decisions
  2. The processor may freely use the data for its own purposes
  3. The processor acts on behalf of the controller and must process only on documented instructions Correct answer.
  4. The processor determines the purposes of processing and bears primary responsibility

Explanation

A processor processes personal data on behalf of the controller and is bound by the controller's documented instructions, including for transfers. The controller determines purposes and means and bears primary accountability.

Question 49Data protection fundamentals and legal frameworks

Which obligation applies to a processor that wishes to engage a sub-processor under the GDPR?

  1. It must transfer controllership to the sub-processor
  2. It needs prior specific or general written authorisation from the controller Correct answer.
  3. It must notify the supervisory authority before each engagement
  4. It may engage any sub-processor without informing the controller

Explanation

A processor may not engage another processor without prior written authorisation, specific or general, from the controller. Where general authorisation is given, the processor must inform the controller of intended changes so objections can be raised.

Question 50Data protection fundamentals and legal frameworks

Which statement best explains why the controller/processor distinction matters for liability?

  1. Controllers bear primary responsibility for compliance and processors are liable for breaches of their specific obligations Correct answer.
  2. The distinction only affects contractual formatting, not liability
  3. Controllers are always immune from fines if a processor errs
  4. Processors are always liable for every infringement committed by the controller

Explanation

The controller is primarily responsible for compliance and for demonstrating it, while processors are liable for infringing their own specific obligations, such as acting outside instructions. Liability therefore follows the role each party plays.