Data Privacy and GDPR

• A. Only information stored in government databases
• B. Any information relating to an identified or identifiable natural person ✓
• C. Only sensitive information such as health or religious beliefs
• D. Only data collected directly from the individual by a company

Why: The GDPR defines personal data broadly as any information relating to an identified or identifiable natural person, including indirect identifiers such as location data or online identifiers.

• A. Data minimisation
• B. Storage limitation
• C. Purpose limitation ✓
• D. Accuracy

Why: Purpose limitation means personal data must be collected for specified, explicit and legitimate purposes and not further processed in a manner incompatible with those purposes.

• A. Deleting all data after one year
• B. Collecting only data that is adequate, relevant, and limited to what is necessary ✓
• C. Storing data in the smallest possible file format
• D. Encrypting all personal data at all times

Why: Data minimisation requires that personal data be adequate, relevant and limited to what is necessary for the purposes for which it is processed.

• A. The organisation's convenience
• B. The data subject's explicit consent ✓
• C. The company's desire to increase profits
• D. Publication in a newspaper

Why: Article 6 GDPR lists six lawful bases, including consent, contract, legal obligation, vital interests, public task and legitimate interests. Consent is one of them; convenience, profit and publication alone are not lawful bases.

• A. The person whose data is being processed
• B. The entity that determines the purposes and means of processing personal data ✓
• C. Any third party that stores the data
• D. The national data protection authority

Why: A data controller is the natural or legal person, public authority, agency or body that determines the purposes and means of processing personal data. The data subject is the individual the data relates to.

• A. Only data that is stored in an encrypted format
• B. Any information relating to an identified or identifiable natural person ✓
• C. Only sensitive information such as health or religious beliefs
• D. Only data collected directly from the data subject by a company

Why: Article 4(1) GDPR defines personal data broadly as any information relating to an identified or identifiable natural person (a 'data subject'). Identifiability can be direct (e.g., a name) or indirect (e.g., an IP address or location data), and the definition is not limited to sensitive data or data collected in a particular way.

• A. Data processor
• B. Data subject
• C. Data controller ✓
• D. Supervisory authority

Why: Under Article 4(7) GDPR, a data controller is the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data. A processor, by contrast, processes personal data on behalf of the controller.

• A. Only the deliberate publication of personal data online
• B. Only the sale of customer databases to third parties
• C. Only the automated analysis of personal data by computers
• D. Any operation performed on personal data, such as collection, storage, or deletion ✓

Why: Article 4(2) GDPR defines processing as any operation or set of operations performed on personal data, whether automated or not. This includes collection, recording, organisation, storage, adaptation, retrieval, use, disclosure, erasure, and destruction, so the concept is very broad.

• A. No, the GDPR only applies to companies established within the EU
• B. Yes, but only if the company has a physical office in the EU
• C. No, only EU citizens' data held in EU servers is covered
• D. Yes, under the territorial scope rules in Article 3(2) GDPR ✓

Why: Article 3(2) GDPR extends the regulation's territorial scope to controllers and processors outside the EU when they process personal data of data subjects who are in the Union, where the processing relates to offering goods or services to them or monitoring their behaviour within the EU. Establishment in the EU is not required.

• A. Email addresses
• B. Purchase history
• C. Job titles
• D. Health data ✓

Why: Article 9 GDPR identifies special categories of personal data, including data concerning health, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data for identification, and data concerning sex life or sexual orientation. Processing these is prohibited by default unless a specific exception applies.

• A. The data subject has given consent to the processing
• B. Processing is necessary for the performance of a contract to which the data subject is party
• C. Processing is necessary for the controller's legitimate interests, provided these are not overridden by the data subject's rights
• D. Processing is necessary because the controller finds it convenient or cost-effective ✓

Why: Article 6(1) lists six lawful bases: consent, contract, legal obligation, vital interests, public task, and legitimate interests. Convenience or cost-effectiveness alone is not a lawful basis; processing must fit one of the six recognised grounds.

• A. Consent
• B. Vital interests
• C. Performance of a contract ✓
• D. Public task

Why: Processing the address is necessary to perform the contract of sale with the customer, which is the contract lawful basis under Article 6(1)(b). Consent is not required for processing that is necessary for a contract the customer has entered into.

• A. Consent can be presumed from a customer's silence or pre-ticked boxes
• B. Consent must be freely given, specific, informed and unambiguous, and can be withdrawn as easily as it was given ✓
• C. Once given, consent cannot be withdrawn by the data subject
• D. Consent is valid if it is buried within the general terms and conditions of a service

Why: Article 4(11) and Article 7 require consent to be a freely given, specific, informed and unambiguous indication of wishes by a clear affirmative action. Data subjects must be able to withdraw consent at any time, and withdrawal must be as easy as giving it.

• A. Legitimate interests
• B. Legal obligation ✓
• C. Vital interests
• D. Consent

Why: Where processing is necessary for compliance with a legal obligation to which the controller is subject, Article 6(1)(c) applies. Tax reporting is a clear example. Consent is generally not a valid basis in an employment context because employees are not seen as freely able to refuse.

• A. Obtain the written approval of the relevant national Data Protection Authority
• B. Carry out a balancing test weighing its interests against the rights and freedoms of the data subject ✓
• C. Register the processing activity in a public government database
• D. Ask the data subject to sign a legitimate interests agreement

Why: Relying on legitimate interests under Article 6(1)(f) requires the controller to balance its own (or a third party's) legitimate interests against the fundamental rights and freedoms of the data subject, often documented as a legitimate interests assessment. No prior regulator approval is needed.

• A. Right to erasure
• B. Right of access ✓
• C. Right to restriction of processing
• D. Right to object

Why: The right of access (Article 15) entitles individuals to confirm whether their personal data is being processed and to receive a copy of that data along with information about the processing.

• A. 7 days
• B. 14 days
• C. One month ✓
• D. 90 days

Why: Article 12(3) requires controllers to respond without undue delay and in any event within one month of receiving the request. This period can be extended by two further months for complex or numerous requests, with notice to the data subject.

• A. Right to data portability
• B. Right to rectification
• C. Right to erasure ✓
• D. Right to restriction of processing

Why: The right to erasure (Article 17) is commonly referred to as the right to be forgotten. It applies in situations such as when data is no longer necessary for its original purpose or when consent is withdrawn, subject to certain exceptions.

• A. Right of access
• B. Right to object
• C. Right to data portability ✓
• D. Right to rectification

Why: Article 20 establishes the right to data portability, which enables individuals to receive their data in a structured, commonly used, machine-readable format and to transfer it to another controller where processing is based on consent or contract and carried out by automated means.

• A. The right to have inaccurate personal data corrected without undue delay ✓
• B. The right to receive a copy of all data held about oneself
• C. The right to stop all processing of personal data permanently
• D. The right to be paid compensation for data misuse

Why: Article 16 gives individuals the right to have inaccurate personal data rectified and incomplete data completed without undue delay. This ensures that the information a controller holds about the individual remains accurate.

• A. Only collect data after the processing activity has already begun
• B. Implement appropriate technical and organisational measures at the outset of designing a processing activity to meet GDPR requirements and protect data subjects' rights
• C. Store all personal data in a single centralised database for easier management
• D. Delay privacy considerations until the system is ready for public launch

• A. Users must manually enable every privacy setting themselves
• B. Only personal data necessary for each specific purpose should be processed by default, with privacy-friendly settings active without user intervention
• C. All data should be collected by default and deleted only on request
• D. Default settings should prioritise data sharing to maximise business value

• A. Collecting a customer's full date of birth when only their age group is needed for the service
• B. Keeping copies of all customer records indefinitely in case they are useful later
• C. Asking only for an email address when that is all that is required to create an account
• D. Gathering additional demographic data from every user for future marketing research

• A. Permanently deleting all identifiers so data can never be linked back to an individual
• B. Replacing identifying fields with artificial identifiers so data cannot be attributed to a specific person without additional information kept separately
• C. Encrypting data so that only the data controller can read it using a public key
• D. Publishing personal data under a pseudonym chosen by the data subject

• A. After a data breach has occurred to determine what went wrong
• B. Only when regulators specifically request one
• C. Before starting processing that is likely to result in a high risk to individuals' rights and freedoms, ideally during the design phase
• D. Once a year for all systems regardless of how they process data

• A. 24 hours
• B. 72 hours ✓
• C. 7 days
• D. 30 days

Why: Article 33 GDPR requires the controller to notify the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of a personal data breach that is likely to result in a risk to individuals' rights and freedoms.

• A. A scheduled backup of customer records completing successfully
• B. An employee accidentally emailing a customer list to the wrong recipient ✓
• C. A company updating its privacy policy on its website
• D. A data subject requesting a copy of their personal data

Why: A personal data breach includes accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data. Sending a customer list to the wrong recipient is an unauthorised disclosure.

• A. Always, for every breach regardless of severity
• B. Only when the breach has been reported to the press
• C. When the breach is likely to result in a high risk to their rights and freedoms ✓
• D. Only when the controller is fined by a regulator

Why: Article 34 requires the controller to communicate a breach to data subjects without undue delay when it is likely to result in a high risk to their rights and freedoms, subject to certain exceptions.

• A. To personally pay any fines imposed by the regulator
• B. To advise the organisation on its obligations and act as a contact point for the supervisory authority ✓
• C. To delete all affected data to prevent further harm
• D. To replace the organisation's IT security team

Why: The DPO advises the controller and staff on GDPR obligations, monitors compliance, and acts as a contact point for supervisory authorities and data subjects. They support, rather than replace, technical and management responsibilities.

• A. Only the names of the employees who discovered the breach
• B. The facts of the breach, its effects, and the remedial action taken ✓
• C. The personal home addresses of all affected customers
• D. A list of competitor companies that may benefit from the data

Why: Article 33(5) requires controllers to document any personal data breach, including its facts, effects, and the remedial action taken, so the supervisory authority can verify compliance with the notification obligation.

• A. Any processing of personal data within a single EU member state
• B. The disclosure or making available of personal data to a recipient located outside the European Economic Area ✓
• C. Storing personal data on a server located inside the European Union
• D. Sending anonymised data to a company within the same country

Why: The GDPR regulates transfers of personal data to recipients in third countries (outside the EEA). Transfers are restricted unless appropriate safeguards or an adequacy decision apply. Anonymised data falls outside GDPR scope, and storage within the EU alone is not a transfer.

• A. A contract between two companies agreeing to share personal data
• B. A decision by the European Commission that a third country provides an adequate level of data protection, allowing transfers without additional safeguards ✓
• C. A self-assessment completed by a controller before transferring data abroad
• D. A certificate issued by a national data protection authority to a processor

Why: Under Article 45 GDPR, the European Commission can determine that a third country, territory, or sector ensures an adequate level of protection. Once such a decision exists, personal data can flow to that country without further transfer mechanisms.

• A. Standard Contractual Clauses (SCCs) adopted by the European Commission ✓
• B. A verbal agreement between the controller and the data subject
• C. Relying on the company's internal privacy policy alone
• D. Transferring data only during business hours

Why: Article 46 GDPR lists appropriate safeguards, including Standard Contractual Clauses, Binding Corporate Rules, and approved codes of conduct or certification mechanisms. Verbal agreements, internal policies alone, and timing of transfers do not meet the requirement.

• A. It invalidated the EU-US Privacy Shield and required controllers relying on SCCs to assess whether the recipient country's laws provide essentially equivalent protection ✓
• B. It confirmed that the Privacy Shield was fully valid and needed no changes
• C. It abolished Standard Contractual Clauses entirely
• D. It granted automatic adequacy to all countries in North America

Why: In Schrems II (2020), the CJEU invalidated the EU-US Privacy Shield. It also held that SCCs remain valid but controllers and exporters must verify, case by case, that the third country's law and practice ensure essentially equivalent protection, sometimes requiring supplementary measures.

• A. An EU company sending customer records to a processor in India
• B. A UK company, which holds an adequacy decision, sending personal data to an EU company ✓
• C. A German company sharing employee data with its US parent company without safeguards
• D. A French company transferring data to a cloud provider located in Singapore

Why: The UK has received an EU adequacy decision, so transfers from the EU/EEA to the UK are permitted without additional safeguards. The other options involve transfers to third countries without adequacy and would require a transfer mechanism such as SCCs or BCRs.