Pass the GDPR, DPO, Certification Exams - Quizzes & Outline

Learn how the GDPR governs the processing of personal data, especially when handled wholly or partly by automated means or as part of a filing system, quiz guidance.

Explain how the GDPR applies to processing by a non-EU established controller or processor when data subjects are in the union, including offering goods or services and monitoring behavior.

Clarifies that pseudonymized personal data remains within GDPR scope under article four, and that the claim it does not apply is false (option B), guiding you to question seven.

Identify how the GDPR treats anonymized data by noting that personal data means information relating to an identified or identifiable natural person, and that anonymized data falls outside GDPR scope.

Identify the payroll company as a data processor under GDPR, with the organization as the controller, processing employees’ personal data on instruction, not as a sub-processor or joint controller.

Define processing under the GDPR as any operation or set of operations performed on personal data, with or without automated means, per article four; confirm option a as correct.

Identify the lead supervisory authority for cross-border gdpr processing as the Italian supervisory authority, because the company's main establishment and central administration are in Italy.

Learn why Company Z becomes the controller by deciding to send promotional offers to Company A's customers, rather than acting as a processor.

Under Article 30 of the GDPR, the controller or processor must maintain records of processing activities under its responsibility and cooperate with supervisory authorities.

Identify the udhr article protecting private life from arbitrary interference, focusing on article 12 regarding family privacy and correspondence; select article 12 as the correct answer.

Explore GDPR penalties for data processing violations: up to 20 million euros or 4% of revenue for serious breaches, and up to 10 million or 2% for less severe infringements.

Clarifies that the European Court of Human Rights interprets the European Convention on Human Rights, is not an EU institution, with jurisdiction recognized by 47 Council of Europe member states.

Practice quiz question 44 examines which institution is FEMA's decision-making body, comparing the European Council, Council of Europe, European Commission, and the Council of the European Union.

Assess GDPR consent requirements through a quiz scenario, identifying active consent via checkboxes, privacy and cookies policy disclosures, and why pre-ticked boxes do not constitute valid consent.

Examine how on-premises cameras with audio recording breach data minimization, storage limitation, and lawfulness and transparency, despite a claimed legitimate basis for safety.

Explore examples of special category data under article nine, with health data as a key example and other sensitive types like racial origin and political opinions.

Identify which item is not personal data by distinguishing an identifiable natural person; a company name is not personal data, while an address, email, and identification number relate to individuals.

the question clarifies that maintaining a record of processing operations is not listed as DPO duty, though a controller or processor may assign this task under articles 29 and 30.

Learn how the GDPR article 12 requires data controllers to respond to data subject requests without undue delay, within one month, and provide reasons and information on remedies.

Explains which exemptions under Article 13 relieve the obligation to provide information to data subjects, focusing on scenarios where personal data is already possessed or not obtained from data subjects.

Explain the GDPR data portability right under Article 20, enabling data subjects to obtain and transfer their personal data to another controller in a structured, machine-readable format.

Identify data portability eligibility under the GDPR by confirming data provided by the data subject to the data controller and excluding third-party data, per article 20(1).

Explain GDPR's contract basis for processing personal data to deliver shoes; processing is lawful to meet contract obligations and may apply as a step toward forming a contract.

Identify when two or more organizations act as joint controllers under Article 26, determining the purposes and means of processing, and explain how this relationship shapes GDPR responsibilities.

Understand when a non-union data controller must designate a written representative under GDPR article 27 for processing related to offering goods or monitoring data subjects in the union.

Explore which records of processing activities must be kept by a data processor under GDPR article 30, clarifying that the purposes are determined by the data controller, not the processor.

Identify which factors are considered under GDPR Article 32 when implementing technical and organizational measures, and learn why the number of data subjects is not considered.

Assess unauthorized email access triggers GDPR penalties, detailing fines up to 20 million euros or 4% of worldwide revenue for breaches of data processing principles, consent, and data subject rights.

Explain GDPR breach notification: data controllers must notify the supervisory authority without undue delay and within 72 hours of discovering a personal data breach, with reasons if delayed.

Identify how retaining customer data indefinitely breaches the storage limitation principle under GDPR, illustrated by Network Inc’s data exposure incident and rapid fix.

Under article 34, when a breach likely risks rights and freedoms, the controller must notify data subjects without undue delay.

Explain GDPR article 34 breach notification rules, identifying when data subjects must be informed without undue delay and exceptions for protective measures and disproportionate effort.

Assess the privacy implications of location-based employee monitoring, conduct a data protection impact assessment under Article 35, and involve the supervisory authority when monitoring poses high risk.