Data privacy culture

• A. Ensuring that data is always stored in encrypted form
• B. Individuals having control over how their personal information is collected, used, and shared ✓
• C. Preventing any organization from collecting customer data
• D. Deleting all data after 30 days regardless of its purpose

Why: Data privacy centers on individuals' rights and control over their personal information, including how it is collected, used, shared, and retained. Encryption is a security measure that supports privacy but is not its definition, and privacy does not prohibit data collection outright.

• A. Only information that is stored in a government database
• B. Only financial information such as bank account numbers
• C. Any information that can be used to identify a specific individual, directly or indirectly ✓
• D. Only data that has been explicitly marked as confidential

Why: Personal data includes any information relating to an identifiable person, such as names, email addresses, IP addresses, or location data. It is not limited to government records, financial data, or labeled documents.

• A. Collecting as much data as possible in case it becomes useful later
• B. Collecting only the data that is adequate, relevant, and necessary for a specific purpose ✓
• C. Storing data in the smallest possible file format
• D. Reducing the number of employees who can access data systems

Why: Data minimization means organizations should limit personal data collection to what is directly needed for a stated purpose. Collecting excess data increases privacy risk and is contrary to this principle.

• A. Data portability
• B. Right to be forgotten ✓
• C. Data anonymization
• D. Consent withdrawal audit

Why: The right to be forgotten, also called the right to erasure, is recognized in regulations such as the GDPR and allows individuals to request deletion of their personal data in specific circumstances. Data portability concerns transferring data, not deleting it.

• A. It guarantees that no data breaches will ever occur
• B. It builds customer trust and supports long-term reputation and relationships ✓
• C. It eliminates the need for any security controls
• D. It allows organizations to sell data without restriction

Why: Strong privacy practices build customer trust, protect brand reputation, and foster lasting relationships. Privacy does not guarantee against breaches, does not replace security controls, and does not permit unrestricted data sales.

• A. The average temperature in a city last July
• B. A person's full name combined with their home address ✓
• C. The total number of cars sold by a manufacturer in 2022
• D. A list of publicly available weather forecasts

Why: Personal data is any information that can identify or relate to a specific individual. A full name combined with a home address clearly identifies a person, whereas the other options are aggregated, general, or not tied to any individual.

• A. Collecting less data always makes systems run faster
• B. Less data reduces the risk and impact of a breach and supports the principle of data minimization ✓
• C. Personal data is only valuable when it is stored in paper form
• D. Regulators require organizations to collect as much data as possible

Why: Data minimization means collecting only what is necessary for a stated purpose. Holding less personal data reduces the amount of harm possible if the data is stolen or misused, and it aligns with privacy laws such as the GDPR.

• A. A person's favorite color
• B. A person's shoe size
• C. A person's health records ✓
• D. A person's preferred newspaper

Why: Health information is typically classed as sensitive or special category data because its exposure can cause significant harm, such as discrimination or embarrassment. Laws often require stronger protections for this type of data.

• A. The data has been encrypted and can be decrypted with a key
• B. The data has been stripped of identifiers so that individuals cannot reasonably be re-identified ✓
• C. The data has been copied to a backup server
• D. The data has been labeled with a user's name for easier searching

Why: Anonymization removes or transforms identifying information so that individuals cannot reasonably be identified, even by the organization holding the data. Encryption is different because encrypted data can be restored to its original form with the key.

• A. They are always stored in insecure formats
• B. Combined, they can often uniquely identify a person even without a name ✓
• C. Governments prohibit the use of dates and postal codes
• D. They can only be used for marketing purposes

Why: This is known as re-identification through quasi-identifiers. Individually harmless details can be combined with other datasets to pinpoint a specific person, which is why privacy protections consider the combined effect of data points.

• A. Data minimisation ✓
• B. Storage limitation
• C. Accountability
• D. Transparency

Why: Data minimisation requires organisations to collect only the personal data necessary for their stated purpose, reducing risk and exposure if a breach occurs.

• A. Purpose limitation and security ✓
• B. Right to portability
• C. Data accuracy only
• D. Consent withdrawal

Why: Moving personal data to a personal account goes beyond the original business purpose and bypasses the security controls the organisation relies on to protect that data.

• A. Keeping all data indefinitely in case it is useful later
• B. Encrypting every file on company servers
• C. Keeping personal data only as long as necessary for its purpose, then deleting or anonymising it ✓
• D. Storing data only in the country where the company is based

Why: Storage limitation means personal data should not be retained longer than needed for the purpose it was collected for, after which it should be securely deleted or anonymised.

• A. Send it, since the vendor is trusted
• B. Check whether the sharing is necessary for a legitimate purpose and whether a data processing agreement is in place ✓
• C. Remove only the employee's name and send the rest
• D. Ask the employee to email it themselves

Why: Good privacy practice requires confirming a legitimate need and appropriate contractual safeguards, such as a data processing agreement, before personal data is shared with a third party.

• A. It lets organisations avoid writing privacy notices
• B. It ensures people know how their personal data is collected, used, and shared, which builds trust and supports their rights ✓
• C. It means publishing all internal company data publicly
• D. It removes the need for consent in every case

Why: Transparency means being open with individuals about what happens to their data, enabling them to understand, question, and exercise their rights over it.

• A. A colleague asks for help formatting a spreadsheet of public event dates
• B. You find a shared folder containing customer names, addresses and payment details that is accessible to all staff
• C. A team member schedules a meeting to discuss quarterly budgets
• D. Your manager requests an updated list of office equipment

• A. Wait to see whether the recipient replies before doing anything
• B. Delete the email from your sent folder and say nothing
• C. Report the incident immediately to your manager and data protection team, following your organisation's breach procedure
• D. Send a follow-up email asking the recipient to ignore the first one and keep quiet about it

• A. A message from a known colleague with a link to the company intranet
• B. An unexpected request for login credentials or personal details, combined with urgent pressure to act now
• C. A monthly newsletter from your HR department
• D. A reminder to complete mandatory training by the deadline

• A. Reporting is only required once a breach has been confirmed by external auditors
• B. Privacy teams need early reports to assess and contain risks quickly, and a false alarm costs far less than a missed incident
• C. Uncertain concerns should be fixed privately so they do not appear in records
• D. Only certain breaches are reportable, so uncertain concerns can safely be ignored

• A. Use the workaround once to check whether it really works
• B. Share the workaround with other team members so they can work more efficiently
• C. Do not use the workaround, and report it to your security or data protection team so the control can be fixed
• D. Ignore it, since the colleague clearly already knows about it

• A. Adding privacy notices only after a product has launched
• B. Building privacy protections into systems, processes, and habits from the start ✓
• C. Relying on legal teams to review privacy issues at the end of a project
• D. Storing as much personal data as possible in case it is needed later

Why: Privacy by Design means considering and embedding privacy protections into systems, processes, and daily practices from the earliest planning stages, rather than adding them as an afterthought.

• A. Send the full spreadsheet, since the vendor is trustworthy
• B. Share only the region data, following the principle of data minimization ✓
• C. Remove the names but send all other columns
• D. Send the file after asking the vendor to delete it later

Why: Data minimization means sharing only the personal data that is necessary for the stated purpose. Since the vendor only needs region data, sharing anything more increases risk without benefit.

• A. Collecting every possible detail in case it becomes useful later
• B. Asking only for fields required for the stated purpose and explaining why each is needed ✓
• C. Making all fields mandatory so that no records are incomplete
• D. Keeping the form open to all staff so anyone can view submitted responses

Why: Limiting collection to necessary fields and explaining their purpose reflects data minimization and transparency, two core principles of Privacy by Design.

• A. Send it in plain text within the email body for easy access
• B. Use approved encryption or a secure internal sharing platform and restrict access to the intended recipient ✓
• C. Forward it to a personal email account so you can access it from home
• D. Post the link on a shared team chat channel with many members

Why: Using approved encryption or secure sharing tools with restricted access protects personal data in transit and ensures only the intended recipient can view it.

• A. Keep them indefinitely in case the project is revisited
• B. Move them to a personal drive so they are not lost
• C. Delete or anonymize them according to the organization's retention policy ✓
• D. Leave them in the shared folder since they are not being used actively

Why: Retaining personal data longer than needed increases risk. Following the retention schedule and deleting or anonymizing data once its purpose has ended is a core privacy practice.

• A. Send the data immediately without verifying who they are
• B. Verify the requester's identity before releasing any personal data ✓
• C. Ignore the request until the customer follows up a second time
• D. Ask the customer to pay a fee before the request can be processed

Why: Before releasing personal data, you must confirm the requester is who they claim to be. Sending data to an unverified person could itself be a data breach, exposing someone else's information to a third party.

• A. 24 hours
• B. One month ✓
• C. Six months
• D. There is no set timeframe

Why: Under the GDPR, organisations generally must respond to a subject access request within one month of receipt, though this can sometimes be extended for complex or numerous requests with notice to the individual.

• A. Wait to see whether the recipient replies before doing anything
• B. Delete the sent email from their own folders and move on
• C. Report the incident to the data protection or security team immediately ✓
• D. Send a follow-up email asking the recipient to keep it quiet

Why: Prompt internal reporting allows the organisation to contain the breach, assess the risk to individuals, and meet any legal obligation to notify the regulator or affected people within the required deadline, which can be as short as 72 hours under the GDPR.

• A. Any change made to a customer's record by an authorised employee
• B. A security incident leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data ✓
• C. Only incidents where hackers steal data from external systems
• D. A request from a customer asking to have their data deleted

Why: A personal data breach is broader than hacking. It includes accidental loss, unauthorised disclosure, and unlawful alteration or access, whether caused by external attackers, insiders, or simple human error.

• A. Delete everything, including the records, to fully honour the request
• B. Refuse the request entirely and take no further action
• C. Delete the data that is not subject to the legal retention requirement and explain why the records must be kept ✓
• D. Transfer the data to a third party so it no longer belongs to your company

Why: The right to erasure is not absolute. Where a legal obligation requires retention, you can keep that specific data while deleting what you are not required to hold, and you should clearly explain the reason to the individual.

• A. Writing a lengthy privacy policy that employees sign once and forget
• B. Leadership visibly modeling privacy-conscious behavior in their own daily work
• C. Assigning privacy compliance entirely to the legal department
• D. Installing monitoring software to catch employees who mishandle data

• A. Because regulators only review products that are already in market
• B. Because retrofitting privacy protections later is typically more costly and less effective
• C. Because early design decisions are never changed once made
• D. Because privacy only matters for products that collect payment information

• A. Collecting as much data as possible in case it becomes useful later
• B. Keeping copies of all datasets on personal devices for convenience
• C. Asking whether a specific data field is truly needed before collecting it
• D. Retaining all customer records indefinitely to avoid deletion errors

• A. Punishing anyone who reports an incident they were partly responsible for
• B. Keeping incident reports confidential only from the employees involved
• C. Creating a blame-free reporting process and recognizing early reporting
• D. Only accepting reports that come with a fully documented root cause analysis

• A. Annual sessions are legally prohibited in most jurisdictions
• B. Regular, short reinforcement helps keep privacy practices current and relevant as roles and threats change
• C. Employees retain information better when training is longer than an hour
• D. Ongoing training eliminates the need for written privacy policies