I85PREP
⌘ K
GDPR Foundation study materials
GDPR Foundation study resources

GDPR Foundation practice questions

One question at a time. Build your GDPR Foundation understanding.

First 50 of 199 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Fundamental principles and concepts of the General Data Protection Regulation (GDRP)

Under the GDPR, which party determines the purposes and means of processing personal data?

  1. The controller Correct answer.
  2. The processor
  3. The data subject
  4. The supervisory authority

Explanation

The controller is the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data. The processor merely processes data on the controller's behalf. Data subjects are the individuals whose data is processed, and supervisory authorities are the regulators.

Question 2Fundamental principles and concepts of the General Data Protection Regulation (GDRP)

Which of the following is a special category of personal data under Article 9 GDPR?

  1. Bank account number
  2. Job title
  3. Postal address
  4. Trade union membership Correct answer.

Explanation

Article 9 lists special categories including racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data for unique identification, health data, and data concerning sex life or sexual orientation. Postal addresses, job titles and bank details are ordinary personal data. Processing special category data is prohibited unless a specific Article 9(2) condition applies.

Question 3Fundamental principles and concepts of the General Data Protection Regulation (GDRP)

A company stores a list of email addresses of its newsletter subscribers. Which GDPR concept does this list constitute?

  1. Anonymised data
  2. Personal data Correct answer.
  3. Aggregated statistics
  4. Pseudonymised data

Explanation

An email address of an identifiable individual is personal data because it relates to an identified or identifiable natural person. Anonymised data falls outside the GDPR because re-identification is not reasonably possible. The list is not pseudonymised because no key replaces the identifiers.

Question 4Fundamental principles and concepts of the General Data Protection Regulation (GDRP)

Which principle requires that personal data be collected for specified, explicit and legitimate purposes and not further processed incompatibly?

  1. Purpose limitation Correct answer.
  2. Accuracy
  3. Storage limitation
  4. Integrity and confidentiality

Explanation

Purpose limitation under Article 5(1)(b) requires that data be collected for specified, explicit and legitimate purposes and not further processed in a manner incompatible with those purposes. Accuracy concerns correctness of data, storage limitation concerns retention periods, and integrity and confidentiality concerns security. Each of these is a separate Article 5 principle.

Question 5Fundamental principles and concepts of the General Data Protection Regulation (GDRP)

Under the GDPR accountability principle, what must a controller be able to do?

  1. Register every processing operation with the supervisory authority in advance
  2. Store all personal data within the European Union
  3. Demonstrate compliance with the data protection principles Correct answer.
  4. Obtain consent from every data subject for all processing

Explanation

Article 5(2) makes the controller responsible for, and able to demonstrate, compliance with the principles. This is the accountability principle. It does not require prior registration of all processing, universal consent, or mandatory EU-only storage, although appropriate safeguards and records are expected.

Question 6Fundamental principles and concepts of the General Data Protection Regulation (GDRP)

Which lawful basis under Article 6 is available to a public authority when performing its official tasks?

  1. Legitimate interests
  2. Consent
  3. Performance of a contract
  4. Public task Correct answer.

Explanation

Article 6(1)(e) permits processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. Article 6(1)(f) legitimate interests is expressly not available to public authorities in the performance of their tasks. Consent and contract are separate bases with their own conditions.

Question 7Fundamental principles and concepts of the General Data Protection Regulation (GDRP)

What is the maximum period for which a controller may keep personal data under the storage limitation principle?

  1. Exactly ten years from collection
  2. Indefinitely, provided the data subject is informed
  3. No longer than is necessary for the purposes for which it was processed Correct answer.
  4. Until the data subject reaches the age of majority

Explanation

Article 5(1)(e) requires that personal data be kept in a form permitting identification of data subjects for no longer than is necessary for the purposes for which the data is processed. There is no fixed universal retention period in the GDPR; controllers must justify retention by reference to purpose and may anonymise data to extend use.

Question 8Fundamental principles and concepts of the General Data Protection Regulation (GDRP)

Which right allows a data subject to obtain a copy of the personal data being processed and information about how it is used?

  1. Right of access Correct answer.
  2. Right to erasure
  3. Right to restriction
  4. Right to rectification

Explanation

Article 15 grants the right of access, enabling data subjects to obtain confirmation of whether their data is processed, a copy of the data, and information such as purposes, categories and recipients. Rectification corrects inaccurate data, erasure removes data, and restriction limits processing. These are distinct rights, each with its own conditions.

Question 9Fundamental principles and concepts of the General Data Protection Regulation (GDRP)

A marketing team wants to send promotional emails to existing customers based on their purchase history. Which assessment is most consistent with the GDPR?

  1. Purchase history is not personal data, so no basis is needed
  2. Legitimate interests can never support direct marketing
  3. The team must rely on a lawful basis and check compatibility and ePrivacy rules Correct answer.
  4. Consent is always required, so the emails must stop until each customer opts in

Explanation

The controller must identify a lawful basis under Article 6, consider whether the new marketing use is compatible with the original purpose under Article 5(1)(b), and comply with applicable ePrivacy rules on electronic marketing. Consent is not the only possible basis, and purchase history linked to a customer is personal data. Legitimate interests can support direct marketing subject to balancing and the right to object.

Question 10Fundamental principles and concepts of the General Data Protection Regulation (GDRP)

A controller receives a request from a data subject to delete an online account. Which statement best reflects the right to erasure?

  1. Erasure applies only where a specific ground in Article 17 is met Correct answer.
  2. The controller must always delete all data immediately without exception
  3. Erasure can only be requested by a supervisory authority
  4. Erasure automatically overrides every legal retention obligation

Explanation

The right to erasure under Article 17 applies where one of the listed grounds is met, such as the data no longer being necessary or consent being withdrawn without another basis. It is not absolute; for example, it does not apply where processing is necessary to comply with a legal obligation or for the establishment or defence of legal claims.

Question 11Fundamental principles and concepts of the General Data Protection Regulation (GDRP)

Which statement best describes the data minimisation principle?

  1. Delete all personal data within one year of collection
  2. Collect only personal data adequate, relevant and limited to what is necessary Correct answer.
  3. Collect as much data as possible in case it becomes useful later
  4. Encrypt all personal data at rest and in transit

Explanation

Article 5(1)(c) requires personal data to be adequate, relevant and limited to what is necessary in relation to the purposes. It concerns the scope of collection rather than security measures or retention periods. Collecting extra data for speculative future use conflicts with this principle.

Question 12Fundamental principles and concepts of the General Data Protection Regulation (GDRP)

A controller transfers personal data to a processor in a third country without an adequacy decision. Which mechanism can lawfully support the transfer?

  1. The data subject's implied consent inferred from silence
  2. A note in the controller's internal privacy policy
  3. A verbal promise from the recipient to be careful
  4. Standard contractual clauses with appropriate safeguards Correct answer.

Explanation

Chapter V permits transfers to third countries where appropriate safeguards exist, such as standard contractual clauses or binding corporate rules, together with enforceable data subject rights and effective legal remedies. Informal promises or internal policies are not recognised transfer tools. Consent must be explicit and informed for Article 49 derogations, not inferred from silence.

Question 13Fundamental principles and concepts of the General Data Protection Regulation (GDRP)

Which factor is most relevant to assessing whether a legitimate interests basis is available?

  1. Whether the data subject has a social media account
  2. The colour of the privacy notice
  3. The balancing of the controller's interests against the data subject's rights and freedoms Correct answer.
  4. The size of the controller's marketing budget

Explanation

Article 6(1)(f) and Recital 47 require a three-part test: a legitimate interest, necessity of processing, and a balancing exercise against the data subject's interests, rights and freedoms. Presentation details, social media presence and budget size do not determine the availability of this basis.

Question 14Fundamental principles and concepts of the General Data Protection Regulation (GDRP)

What does the principle of integrity and confidentiality require of a controller?

  1. Publishing all processing activities on a public website
  2. Restricting processing to paper records only
  3. Processing data in a manner that ensures appropriate security Correct answer.
  4. Obtaining fresh consent every time data is accessed

Explanation

Article 5(1)(f) requires processing in a manner that ensures appropriate security of personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures. Publication, repeated consent and paper-only records are not required by this principle.

Question 15Fundamental principles and concepts of the General Data Protection Regulation (GDRP)

A data subject objects to processing carried out for direct marketing purposes. What is the controller's obligation?

  1. Continue processing until the next review cycle
  2. Stop processing for direct marketing without needing to justify further Correct answer.
  3. Transfer the data to a processor instead
  4. Ask the supervisory authority for permission to continue

Explanation

Article 21(2) gives an absolute right to object to processing for direct marketing; once an objection is received, the controller must cease that processing and does not need to demonstrate compelling grounds. For other purposes, the controller may continue only if it demonstrates overriding legitimate grounds.

Question 16Fundamental principles and concepts of the General Data Protection Regulation (GDRP)

Which statement correctly describes the relationship between pseudonymisation and the GDPR?

  1. Pseudonymisation removes the need for a lawful basis
  2. Pseudonymised data is always outside the scope of the GDPR
  3. Pseudonymised data remains personal data and can benefit from reduced risk Correct answer.
  4. Pseudonymisation is the same as anonymisation

Explanation

Recital 26 confirms that pseudonymised data, which could be attributed to a natural person by the use of additional information, remains personal data. Article 32 encourages pseudonymisation as a security measure that can reduce risk, but it does not take data outside the GDPR or remove the need for a lawful basis.

Question 17Fundamental principles and concepts of the General Data Protection Regulation (GDRP)

Which of the following best illustrates the transparency principle in practice?

  1. Hiding the privacy notice in a rarely visited webpage
  2. Using complex legal language to describe data uses
  3. Providing clear, concise information about processing before it begins Correct answer.
  4. Explaining processing only after a complaint is received

Explanation

Article 5(1)(a) and Articles 12 to 14 require that information about processing be provided in a concise, transparent, intelligible and easily accessible form, using clear and plain language, generally at the time data is obtained. Concealment, delayed disclosure or obscure drafting undermines transparency.

Question 18Fundamental principles and concepts of the General Data Protection Regulation (GDRP)

What is the role of a data protection officer (DPO) under the GDPR?

  1. To inform and advise the controller or processor and monitor compliance Correct answer.
  2. To act as the sole decision-maker on erasure requests
  3. To determine the lawful basis for every processing operation
  4. To represent data subjects in court proceedings

Explanation

Article 39 tasks the DPO with informing and advising the controller or processor, monitoring compliance, providing advice on impact assessments and cooperating with the supervisory authority. The DPO does not personally determine lawful bases or decide individual rights requests, and does not act as legal counsel for data subjects.

Question 19Fundamental principles and concepts of the General Data Protection Regulation (GDRP)

A controller processes health data of patients in a hospital. Which additional requirement applies compared with processing ordinary personal data?

  1. The controller must obtain consent from all employees
  2. A condition in Article 9(2) must be satisfied in addition to a lawful basis Correct answer.
  3. The data must be deleted within 24 hours of collection
  4. The data must be stored outside the European Union

Explanation

Health data is a special category under Article 9(1), so processing is prohibited unless a condition in Article 9(2) applies, such as provision of health care under Article 9(2)(h), in addition to an Article 6 lawful basis. There is no 24-hour deletion rule, no requirement to store data outside the EU, and employee consent is not a general requirement.

Question 20Fundamental principles and concepts of the General Data Protection Regulation (GDRP)

Which processing activity is most likely to require a data protection impact assessment?

  1. Systematic large-scale monitoring of a public area Correct answer.
  2. Publishing a company's annual report
  3. Sending a routine invoice to a customer
  4. Recording a single employee's holiday dates

Explanation

Article 35 requires a DPIA where processing is likely to result in a high risk to rights and freedoms, particularly for systematic and extensive evaluation or large-scale monitoring of publicly accessible areas. Routine invoicing, single HR entries and publishing non-personal corporate information generally do not meet that threshold.

Question 21Fundamental principles and concepts of the General Data Protection Regulation (GDRP)

A controller wants to rely on consent for processing. Which requirement must be satisfied for that consent to be valid?

  1. It must be implied from the data subject's silence
  2. It must be freely given, specific, informed and unambiguous Correct answer.
  3. It must be obtained in writing by a notary
  4. It must be renewed every 30 days

Explanation

Article 4(11) defines consent as any freely given, specific, informed and unambiguous indication of the data subject's wishes, given by a statement or clear affirmative action. Silence, pre-ticked boxes and inactivity do not constitute consent, and the GDPR sets no notarisation or 30-day renewal requirement.

Question 22Fundamental principles and concepts of the General Data Protection Regulation (GDRP)

A company collects customer data for a loyalty scheme and later wants to sell anonymised insights to partners. Which statement is most accurate under the GDPR?

  1. The loyalty scheme data must be deleted before any analysis
  2. Anonymised insights remain personal data and need a lawful basis
  3. Anonymised insights fall outside the GDPR if re-identification is not reasonably possible Correct answer.
  4. Selling insights requires consent from the supervisory authority

Explanation

Recital 26 states that the GDPR does not apply to anonymous information, meaning data that does not relate to an identified or identifiable natural person or data rendered anonymous so that re-identification is not reasonably possible. If the anonymisation is robust, the resulting insights are outside the GDPR, though the original data and the anonymisation process remain subject to it.

Question 23Fundamental principles and concepts of the General Data Protection Regulation (GDRP)

A controller relies on legitimate interests and later receives an objection from a data subject based on their particular situation. What must the controller do?

  1. Refer the objection to the data subject's employer
  2. Continue processing because legitimate interests always prevail
  3. Stop processing unless it demonstrates compelling legitimate grounds that override the data subject's interests Correct answer.
  4. Ignore the objection if the data was collected indirectly

Explanation

Article 21(1) allows a data subject to object, on grounds relating to their particular situation, to processing based on Article 6(1)(e) or (f). The controller must then cease processing unless it demonstrates compelling legitimate grounds that override the data subject's interests, rights and freedoms, or grounds for legal claims. This does not apply to the absolute objection for direct marketing.

Question 24Fundamental principles and concepts of the General Data Protection Regulation (GDRP)

Which combination best reflects the relationship between the Article 5 principles and the accountability obligation?

  1. The principles apply only to automated processing, while accountability applies to manual files
  2. Accountability replaces the principles once a certification is obtained
  3. The principles set substantive standards, and accountability requires the controller to demonstrate compliance with them Correct answer.
  4. The principles apply only to special category data, while accountability covers ordinary data

Explanation

Article 5(1) sets out substantive principles such as lawfulness, fairness, transparency, purpose limitation, minimisation, accuracy, storage limitation and integrity and confidentiality. Article 5(2) adds that the controller is responsible for, and must be able to demonstrate, compliance. Certification may support evidence of compliance but does not displace the principles, and both apply across manual and automated processing.

Question 25Fundamental principles and concepts of the General Data Protection Regulation (GDRP)

A processor sub-contracts part of its processing to another company without the controller's authorisation. How does the GDPR characterise this?

  1. A matter solely for the sub-processor's own supervisory authority
  2. A permitted efficiency measure requiring no further step
  3. A transfer of controllership to the sub-processor
  4. A breach of Article 28 unless prior specific or general written authorisation was given Correct answer.

Explanation

Article 28(2) provides that a processor shall not engage another processor without prior specific or general written authorisation of the controller. Where general written authorisation is given, the processor must inform the controller of intended changes so the controller can object. Unauthorised sub-processing breaches the Article 28 obligations and does not transfer controllership.

Question 26Fundamental principles and concepts of the General Data Protection Regulation (GDRP)

Under Article 4 GDPR, which of the following best describes a 'controller'?

  1. The natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data Correct answer.
  2. The natural person whose personal data are being processed by an organisation
  3. The supervisory authority competent for monitoring compliance with the GDPR in a Member State
  4. The natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller

Explanation

Article 4(7) defines the controller as the entity that alone or jointly with others determines the purposes and means of the processing. The decisive element is the decision-making power over why and how data are processed, regardless of whether the entity actually carries out the operations itself.

Question 27Fundamental principles and concepts of the General Data Protection Regulation (GDRP)

Which of the following is personal data within the meaning of Article 4(1) GDPR?

  1. A publicly available list of company registration numbers with no link to individuals
  2. Aggregated statistics showing the average age of all residents of a country, with no individual identifiable
  3. The total number of visitors recorded by a building's anonymous door counter
  4. A pseudonymised customer record that can be re-linked to a named individual using a separately held key Correct answer.

Explanation

Pseudonymised data remain personal data because additional information, the key, allows the data to be attributed to an identified or identifiable natural person. Article 4(1) treats identifiability as the criterion, and pseudonymisation reduces but does not remove that link.

Question 28Fundamental principles and concepts of the General Data Protection Regulation (GDRP)

A controller must ensure that personal data are processed lawfully, fairly and in a transparent manner. Which Article 5 principle does this requirement express?

  1. Storage limitation
  2. Purpose limitation
  3. Lawfulness, fairness and transparency Correct answer.
  4. Data minimisation

Explanation

Article 5(1)(a) sets out the lawfulness, fairness and transparency principle, which requires a valid legal basis, treatment that does not mislead or harm data subjects, and clear information about processing. The other principles in Article 5 address separate, cumulative requirements.

Question 29Fundamental principles and concepts of the General Data Protection Regulation (GDRP)

Under the GDPR, what is the default time limit for a controller to respond to a data subject access request?

  1. Six months from receipt of the request, with no possibility of extension
  2. One month from receipt of the request, extendable by a further two months where the request is complex or numerous Correct answer.
  3. Forty-eight hours from receipt of the request, extendable at the controller's discretion
  4. Ten working days from receipt of the request, with no possibility of extension

Explanation

Article 12(3) requires the controller to provide information on action taken without undue delay and in any event within one month of receipt of the request. That period may be extended by two further months where necessary, taking into account the complexity and number of requests, and the data subject must be informed of any extension.

Question 30Fundamental principles and concepts of the General Data Protection Regulation (GDRP)

Which statement correctly reflects the GDPR position on the processing of special categories of personal data such as health data?

  1. They may be processed without restriction once the data subject has been informed
  2. They are subject to an additional prohibition under Article 9 unless a specific exemption in Article 9(2) applies Correct answer.
  3. They may only be processed by public authorities and never by private organisations
  4. They may be processed freely provided a valid Article 6 lawful basis exists

Explanation

Article 9(1) prohibits processing of special category data, which includes health data, and Article 9(2) provides exhaustive exemptions such as explicit consent or employment law obligations. A controller therefore needs both an Article 6 lawful basis and an Article 9(2) condition.

Question 31Fundamental principles and concepts of the General Data Protection Regulation (GDRP)

Which of the following correctly identifies the right granted by Article 15 GDPR?

  1. The right to receive personal data in a structured, commonly used and machine-readable format for transmission to another controller
  2. The right to have inaccurate personal data rectified without undue delay
  3. The right to restrict processing while the accuracy of the data is contested
  4. The right to obtain confirmation of whether personal data are being processed and access to that data together with specified information Correct answer.

Explanation

Article 15 confers the right of access: the data subject may obtain confirmation as to whether personal data concerning them are being processed and, where that is the case, access to the data and the information listed in Article 15(1). The other options describe distinct rights in Articles 16 to 20.

Question 32Fundamental principles and concepts of the General Data Protection Regulation (GDRP)

Where a controller relies on the legitimate interests basis in Article 6(1)(f), what is the controller required to do?

  1. Restrict the processing to personal data that has been pseudonymised
  2. Conduct a balancing exercise and document that its interests are not overridden by the data subject's rights and freedoms Correct answer.
  3. Obtain prior approval from the supervisory authority before starting the processing
  4. Obtain explicit consent from the data subject in addition to the balancing exercise

Explanation

Article 6(1)(f) permits processing necessary for legitimate interests pursued by the controller or a third party, except where those interests are overridden by the interests or fundamental rights and freedoms of the data subject. The controller must therefore carry out and be able to demonstrate a three-part assessment: a legitimate interest, necessity of the processing, and a balancing of interests.

Question 33Fundamental principles and concepts of the General Data Protection Regulation (GDRP)

What does the accountability principle in Article 5(2) require of a controller?

  1. That the controller obtain consent for all processing activities
  2. That the controller be able to demonstrate compliance with the other data protection principles Correct answer.
  3. That the controller appoint a data protection officer in every case
  4. That the controller register every processing operation with the supervisory authority

Explanation

Article 5(2) makes the controller responsible for, and able to demonstrate, compliance with the principles in Article 5(1). This underpins obligations such as maintaining records of processing, adopting policies and carrying out assessments, and it shifts the burden of proof onto the controller.

Question 34Fundamental principles and concepts of the General Data Protection Regulation (GDRP)

A retailer collects email addresses at checkout solely to send order confirmations, then begins using the same addresses for a weekly newsletter. Which Article 5 principle is most directly engaged by this change of use?

  1. Storage limitation
  2. Purpose limitation Correct answer.
  3. Integrity and confidentiality
  4. Accuracy

Explanation

Article 5(1)(b) requires personal data to be collected for specified, explicit and legitimate purposes and not further processed in a manner incompatible with those purposes. Using order data for marketing is a new purpose, so the retailer must assess compatibility or rely on a separate lawful basis such as consent.

Question 35Fundamental principles and concepts of the General Data Protection Regulation (GDRP)

An online service asks users to tick a pre-ticked box to accept its privacy policy during sign-up. Which statement best reflects the GDPR position on this consent?

  1. The consent is valid provided the privacy policy is displayed in full on the same page
  2. The consent is invalid because silence or pre-ticked boxes do not constitute a clear affirmative action Correct answer.
  3. The consent is invalid only if the user later objects to the processing
  4. The consent is valid because the user completed the sign-up process

Explanation

Article 4(11) and Article 7 require consent to be a freely given, specific, informed and unambiguous indication of the data subject's wishes by a statement or clear affirmative action. Recital 32 confirms that silence, pre-ticked boxes and inactivity do not amount to consent.

Question 36Fundamental principles and concepts of the General Data Protection Regulation (GDRP)

A controller plans to transfer personal data to a processor established in a country with no adequacy decision. Which mechanism can the controller lawfully use to frame the transfer?

  1. A unilateral statement by the controller that the transfer is necessary for its business
  2. Standard contractual clauses adopted by the European Commission, subject to a transfer impact assessment Correct answer.
  3. A verbal assurance from the importer that it will apply the GDPR
  4. The processor's own internal privacy policy published on its website

Explanation

Article 46 permits transfers subject to appropriate safeguards, including standard data protection clauses adopted by the Commission. Following the Schrems II judgment, the exporter should also assess whether the law and practice of the destination country undermine those safeguards and adopt supplementary measures where needed.

Question 37Fundamental principles and concepts of the General Data Protection Regulation (GDRP)

Under Article 28 GDPR, which element must a contract between a controller and a processor contain?

  1. A clause transferring all controller liability to the processor
  2. A provision requiring the processor to act only on documented instructions from the controller Correct answer.
  3. A commitment by the processor to appoint a data protection officer
  4. An obligation on the processor to publish the controller's records of processing

Explanation

Article 28(3)(a) requires the processor to process personal data only on documented instructions from the controller, including with regard to transfers to a third country. Article 28(3) lists further mandatory terms, such as confidentiality, security, sub-processor rules, assistance with data subject rights and deletion or return of data.

Question 38Fundamental principles and concepts of the General Data Protection Regulation (GDRP)

A hospital wishes to rely on Article 9(2)(h) to process patient health data for medical diagnosis. What does this provision require in addition to the processing being necessary for those purposes?

  1. That the processing be carried out by or under the responsibility of a professional subject to a legal obligation of professional secrecy Correct answer.
  2. That the processing be limited to data collected in the previous twelve months
  3. That every patient give written consent before any processing occurs
  4. That the data be transferred to a public health authority

Explanation

Article 9(2)(h) permits processing necessary for the purposes of preventive or occupational medicine, medical diagnosis, provision of health care or treatment, and management of health care systems, where the data are processed by or under the responsibility of a professional bound by professional secrecy. National law may add further conditions under Article 9(3).

Question 39Fundamental principles and concepts of the General Data Protection Regulation (GDRP)

A company wants to build a profile of individual customers to predict their creditworthiness. Which statement best describes the GDPR's treatment of this activity?

  1. Profiling is permitted only where it produces legal effects, in which case no additional safeguards apply
  2. Profiling falls outside the GDPR because it does not involve storage of personal data
  3. Profiling is prohibited unless the data subject is a business customer
  4. Profiling is a form of processing subject to the GDPR, and solely automated decisions with legal or similarly significant effects attract specific safeguards under Article 22 Correct answer.

Explanation

Article 4(4) defines profiling as automated processing to evaluate personal aspects, and it is processing of personal data subject to the full GDPR. Article 22 adds specific protections where a decision based solely on automated processing, including profiling, produces legal effects or similarly significantly affects the data subject.

Question 40Fundamental principles and concepts of the General Data Protection Regulation (GDRP)

A controller discovers that a processor has engaged a sub-processor without the required authorisation. How does the GDPR allocate responsibility?

  1. The supervisory authority bears responsibility for the sub-processor's acts
  2. No liability arises because the controller remains responsible for all processing in every case
  3. The sub-processor alone is liable, because the controller has no contractual relationship with it
  4. The processor is liable to the controller for the performance of the sub-processor's obligations, and the sub-processor is bound by the same data protection obligations Correct answer.

Explanation

Article 28(2) requires prior specific or general written authorisation for sub-processors, and Article 28(4) provides that where a processor engages a sub-processor, the same data protection obligations as in the controller-processor contract are imposed on the sub-processor. The processor remains fully liable to the controller for the sub-processor's performance.

Question 41Fundamental principles and concepts of the General Data Protection Regulation (GDRP)

Which of the following best explains the relationship between the data minimisation principle and the accuracy principle?

  1. Accuracy requires retaining all historical versions of data, which overrides data minimisation
  2. They are alternative principles, and a controller may choose to comply with only one
  3. Data minimisation requires deletion of all data once collected, which makes accuracy irrelevant
  4. Data minimisation limits what is collected to what is necessary, while accuracy requires that data be correct and kept up to date; both apply cumulatively Correct answer.

Explanation

Article 5(1)(c) requires data to be adequate, relevant and limited to what is necessary, while Article 5(1)(d) requires data to be accurate and, where necessary, kept up to date. The principles operate together: a controller should collect only necessary data and ensure that what it holds is correct.

Question 42Fundamental principles and concepts of the General Data Protection Regulation (GDRP)

A data subject asks a controller to erase personal data that the controller is processing to comply with a legal obligation under EU law. Which outcome best reflects Article 17 GDPR?

  1. The erasure request must be forwarded to the supervisory authority for decision
  2. The erasure request must be granted only if the data subject pays an administrative fee
  3. The erasure request must be granted because the right to erasure is absolute
  4. The erasure request may be refused because Article 17(3) provides an exception where processing is necessary for compliance with a legal obligation Correct answer.

Explanation

Article 17(1) grants the right to erasure, but Article 17(3) lists exceptions, including where processing is necessary for compliance with a legal obligation to which the controller is subject. Where such an obligation exists, the controller may refuse the request and should explain the reason to the data subject.

Question 43Fundamental principles and concepts of the General Data Protection Regulation (GDRP)

A controller intends to rely on consent as its lawful basis and also wishes to rely on the same consent to justify a transfer to a third country without an adequacy decision. Which statement is correct?

  1. Consent for processing automatically covers the transfer, so no separate consideration is needed
  2. Consent may serve as a Chapter V transfer tool only where the data subject is informed of the possible risks of the transfer and gives explicit consent Correct answer.
  3. Consent can never be used as a transfer mechanism under any circumstances
  4. Consent for transfer requires approval by the European Data Protection Board in each case

Explanation

Article 49(1)(a) permits transfers where the data subject has explicitly consented to the proposed transfer after being informed of the possible risks of such transfers arising from the absence of an adequacy decision and appropriate safeguards. This is a derogation to be used occasionally rather than for routine transfers.

Question 44Fundamental principles and concepts of the General Data Protection Regulation (GDRP)

Which of the following best describes how the GDPR treats pseudonymisation?

  1. It is a security and minimisation measure that reduces risk but the data remain personal data Correct answer.
  2. It permits a controller to disregard data subject rights
  3. It is mandatory for all processing of special category data
  4. It renders data anonymous and therefore outside the scope of the GDPR

Explanation

Article 4(5) defines pseudonymisation as processing that makes data no longer attributable to a specific data subject without additional information kept separately and protected. Article 32(1)(a) and Article 5(1)(c) treat it as a measure that can support security and minimisation, but pseudonymised data remain personal data.

Question 45Fundamental principles and concepts of the General Data Protection Regulation (GDRP)

A controller's processing is based on the performance of a contract with the data subject. The data subject objects under Article 21(1) on grounds relating to their particular situation. What is the correct analysis?

  1. The controller may continue processing only if it obtains fresh consent from the data subject
  2. The objection is invalid because Article 21 applies only to processing based on legitimate interests
  3. The controller may continue processing if it demonstrates compelling legitimate grounds that override the data subject's interests, or grounds for the establishment, exercise or defence of legal claims Correct answer.
  4. The objection must be honoured automatically because Article 21(1) gives an absolute right

Explanation

Article 21(1) applies to processing based on Article 6(1)(e) or (f), and it also applies where the objection relates to processing based on a contract or consent in the limited situations described in Article 21(2) and (3). Under Article 21(1) the controller must stop unless it demonstrates compelling legitimate grounds that override the data subject's interests, rights and freedoms, or grounds relating to legal claims.

Question 46Fundamental principles and concepts of the General Data Protection Regulation (GDRP)

Which statement best captures the role of a data protection officer (DPO)?

  1. The DPO decides the lawful basis for each processing operation on behalf of the controller
  2. The DPO monitors compliance with the GDPR, advises the controller or processor and acts as contact point for the supervisory authority, while being involved in an independent manner Correct answer.
  3. The DPO may be instructed by the controller on how to interpret the GDPR in individual cases
  4. The DPO is personally liable for every data breach suffered by the organisation

Explanation

Article 39 sets out the DPO's tasks, including informing and advising the controller or processor, monitoring compliance, providing advice on data protection impact assessments and cooperating with the supervisory authority. Article 38 requires the DPO to be involved properly and to act with independence, without receiving instructions on the exercise of those tasks.

Question 47Fundamental principles and concepts of the General Data Protection Regulation (GDRP)

A controller receives a request from a data subject for a copy of their personal data. Which factor is decisive in determining whether the controller may charge a fee?

  1. Whether the request is manifestly unfounded or excessive, in particular because of its repetitive character Correct answer.
  2. Whether the data subject is a consumer or a business
  3. The country in which the controller is established
  4. The length of the personal data being requested

Explanation

Article 12(5) allows a controller to charge a reasonable fee based on administrative costs, or to refuse to act, only where requests are manifestly unfounded or excessive, in particular because of their repetitive character. Otherwise information and responses under Articles 13 to 15 and 16 to 22 must be provided free of charge.

Question 48Fundamental principles and concepts of the General Data Protection Regulation (GDRP)

A controller wants to process personal data for a new purpose that is not compatible with the original purpose. Which route is available under Article 6(4)?

  1. The controller may proceed where the processing is based on the data subject's consent or on a Union or Member State law constituting a necessary and proportionate measure in a democratic society Correct answer.
  2. The controller may proceed if it notifies the supervisory authority within 72 hours
  3. The controller may proceed only if the new purpose is commercial rather than public
  4. The controller may proceed without any further condition because the data were lawfully collected

Explanation

Article 6(4) permits further processing for a purpose other than that for which the data were collected where the processing is based on the data subject's consent or on Union or Member State law that is necessary and proportionate in a democratic society to safeguard the objectives in Article 23(1). Otherwise the controller must assess compatibility, taking into account the factors listed in Article 6(4).

Question 49Fundamental principles and concepts of the General Data Protection Regulation (GDRP)

Which of the following best explains why the Article 5 principles are described as interdependent rather than a checklist?

  1. Because a controller need only satisfy the principle that is most relevant to its sector
  2. Because the principles are advisory and enforceable only through national contract law
  3. Because the principles apply only to public authorities and not to private controllers
  4. Because compliance with one principle can affect compliance with others, and accountability requires the controller to demonstrate compliance with all of them together Correct answer.

Explanation

Article 5(1) principles operate cumulatively: for example, minimising data supports storage limitation, and accurate records support transparency. Article 5(2) adds accountability, requiring the controller to be able to demonstrate compliance with all of the principles, which is why they are described as interdependent rather than optional.

Question 50Fundamental principles and concepts of the General Data Protection Regulation (GDRP)

A controller relies on Article 6(1)(f) for a processing operation and receives an objection under Article 21(1). The controller wishes to continue processing. Which statement best reflects the applicable test?

  1. The controller need only show that it had a legitimate interest at the outset of processing
  2. The controller must show that the data subject consented to the original processing
  3. The controller must show that its legitimate interests are compelling and override the data subject's interests, rights and freedoms, or that processing is needed for legal claims Correct answer.
  4. The controller must show that the supervisory authority has approved the continuation

Explanation

Article 21(1) requires the controller to cease processing following an objection unless it demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or grounds for the establishment, exercise or defence of legal claims. The threshold is higher than the original balancing test under Article 6(1)(f).