Pass the GDPR, DPO, Certification Exams - Quizzes & Outline

Learn how the GDPR governs the processing of personal data, especially when handled wholly or partly by automated means or as part of a filing system, quiz guidance.

Explain how the GDPR applies to processing by a non-EU established controller or processor when data subjects are in the union, including offering goods or services and monitoring behavior.

The GDPR does not apply to an American company with a site accessible to EU residents if the company does not target or monitor EU residents' personal data.

Test your understanding of the GDPR's applicability to Tom's data in question four, a Spain-targeted scenario; 'data subjects in the union' include EU citizens, residents, and tourists.

Identify which item is not personal data under the GDPR: the company registration number does not relate to an identifiable person, unlike health information or biometric information.

Clarifies that pseudonymized personal data remains within GDPR scope under article four, and that the claim it does not apply is false (option B), guiding you to question seven.

Identify how the GDPR treats anonymized data by noting that personal data means information relating to an identified or identifiable natural person, and that anonymized data falls outside GDPR scope.

According to the GDPR, Company A is the data controller, determining the purposes and means of collecting email and birth date to open an online account.

Identify the payroll company as a data processor under GDPR, with the organization as the controller, processing employees’ personal data on instruction, not as a sub-processor or joint controller.

Under the GDPR, a sub-processor carries out processing on behalf of the controller. In the payroll example, Company B is the sub-processor.

Define processing under the GDPR as any operation or set of operations performed on personal data, with or without automated means, per article four; confirm option a as correct.

Identify that under the GDPR, genetic data means personal data relating to inherited or acquired genetic characteristics that give unique information about physiology or health.

Identify the lead supervisory authority for cross-border gdpr processing as the Italian supervisory authority, because the company's main establishment and central administration are in Italy.

Identify the lead supervisory authority for cross-border marketing data processing under the GDPR, specifically the French supervisory authority, when decisions are made in France rather than Germany.

Learn why Company Z becomes the controller by deciding to send promotional offers to Company A's customers, rather than acting as a processor.

Explains the GDPR data processing principles, identifies storage limitation as the violation when a company keeps customer data beyond the contractual period, and highlights related concepts.

Identify the GDPR principle violated when a company fails to encrypt a portable memory drive, highlighting integrity and confidentiality under Article V.

Explain the GDPR data minimization principle with a social media account scenario, showing that collecting email, phone, photo ID, names, and address is excessive; correct answer is C.

Clarify GDPR data subject request response timelines: controllers must respond without undue delay and within 30 days, with a possible two-month extension for complexity and informing the data subject.

Learn when GDPR deletion requests can be denied, citing Article 17 exceptions like freedom of expression, legal obligations, public health, and archiving, illustrated by a Smart Ltd case.

Explain how GDPR requires explicit, affirmative consent for processing personal data for promotional emails; automatic consent violates this standard, as highlighted by recital 32.

Explain the age threshold for processing a child's data in information society services, noting sixteen years as the correct answer under article eight with parental consent and possible lower ages.

Identify that not requiring login credentials for a workstation compromises security and violates GDPR article 5, which requires appropriate security of personal data and integrity and confidentiality.

The company's initial processing for payment and delivery complies with the purpose limitation principle under GDPR Article 5, which requires data be collected for specified, explicit and legitimate purposes.

Assess how processing customer data for personalized offers aligns with the initial purpose under GDPR, highlighting purpose limitation, compatibility, and data minimization in a grocery delivery scenario.

Learn which entries do not belong in an organization's record of processing activities. Aggregated data, such as employee turnover rate, is not personal data.

Under Article 30 of the GDPR, the controller or processor must maintain records of processing activities under its responsibility and cooperate with supervisory authorities.

clarifies that under GDPR, companies under 250 employees are exempt from recording processing activities unless processing risks rights and freedoms or involves special categories of data, per article 30.

Assess the GDPR penalties for failing to maintain records of processing activities, including fines up to 10 million euros or 2% of annual turnover, under article 30 and related provisions.

Understand GDPR consent: data subjects must know the controller's identity and processing purposes; controllers must demonstrate informed consent and provide a privacy policy, with genuine freedom to choose.

Identify the udhr article protecting private life from arbitrary interference, focusing on article 12 regarding family privacy and correspondence; select article 12 as the correct answer.

Investigate GDPR rights shown in question 32, including the right to object to processing, the right to access data, and the right to be forgotten under Article 17.

Examine how GDPR data subject rights requests require telecoms to respond without undue delay and within one month, per article 12, with possible 12-month extensions under articles 15–22.

Explore GDPR penalties for data processing violations: up to 20 million euros or 4% of revenue for serious breaches, and up to 10 million or 2% for less severe infringements.

Assesses GDPR personal data processing, highlighting that no valid consent exists and the household exemption does not apply; consent is required under article 6.

Explore GDPR data processing principles through a prank-call app scenario, highlighting transparency, storage limitation, and purpose limitation, and identify that integrity and sovereignty is the violated principle (Articles 13–14).

Explore how data protection authorities assess GDPR violations and administrative fines under Article 83, detailing factors like nature, duration, scope, affected data subjects, and mitigation actions.

Explore question 38 on which institution collaborates with the European Parliament, the European Council, and the European Data Protection Board to consult the EU and influence budget decisions.

Explain which European Convention on Human Rights article mirrors UDHR Article 12, identifying Article 8 as similar and protecting private and family life, home, and correspondence.

Clarifies that the European Court of Human Rights interprets the European Convention on Human Rights, is not an EU institution, with jurisdiction recognized by 47 Council of Europe member states.

Identify the European Commission as the EU executive body responsible for drawing up proposals for new legislation, and note that the Council of Europe is not an EU body.

Explain which role the European Parliament does not perform: proposing new EU laws and policies; it conducts supervisory oversight and, with the Council, establishes the EU budget.

Understand the Council of the European Union, the main decision-making body with executive powers in the European Union, through quiz question 43 and its explanation.

Practice quiz question 44 examines which institution is FEMA's decision-making body, comparing the European Council, Council of Europe, European Commission, and the Council of the European Union.

Identify the European Parliament as the EU lawmaking body, directly elected by EU voters every five years, in this GDPR certification exam quiz.

Assess GDPR consent requirements through a quiz scenario, identifying active consent via checkboxes, privacy and cookies policy disclosures, and why pre-ticked boxes do not constitute valid consent.

Perform a data protection impact assessment when processing personal data with high privacy risk by a data controller using cameras with built-in microphones and a real-time exit access app.

Examine how on-premises cameras with audio recording breach data minimization, storage limitation, and lawfulness and transparency, despite a claimed legitimate basis for safety.

Explore examples of special category data under article nine, with health data as a key example and other sensitive types like racial origin and political opinions.

Identify which item is not personal data by distinguishing an identifiable natural person; a company name is not personal data, while an address, email, and identification number relate to individuals.

Determine that when a data subject withdraws consent, a data controller must stop processing based on consent and cannot switch to legitimate interests.

Navigate section four of the GDPR course with a twenty-five question quiz, reviewing WP29 guidelines, the history of data protection law, and EU institutions shaping data protection legislation.

Identify when a data protection officer is required under GDPR Article 37, noting courts acting in their judicial capacity are exempt and public authorities with large-scale processing require a DPO.

The appointment of a data protection officer is voluntary for companies, with mandatory appointment only under specific conditions outlined by article 33, article 37, and data protection guidelines.

Explore which organization is not required to appoint a data protection officer under the GDPR by analyzing large-scale, regular and systematic monitoring and processing of sensitive data.

the question clarifies that maintaining a record of processing operations is not listed as DPO duty, though a controller or processor may assign this task under articles 29 and 30.

Determine that the data protection officer directly reports to the highest management level of the controller or the processor, per article seven.

Explain how data controllers may request additional information to verify a data subject's identity under GDPR, Article 12, and how doubts about identity affect access, deletion, and portability requests.

Learn how the GDPR article 12 requires data controllers to respond to data subject requests without undue delay, within one month, and provide reasons and information on remedies.

Explains which exemptions under Article 13 relieve the obligation to provide information to data subjects, focusing on scenarios where personal data is already possessed or not obtained from data subjects.

Learn about the GDPR right of access under Article 15, including what information data subjects are entitled to, such as purposes, categories of data, recipients, retention, and safeguards for transfers.

Understand a data subject's right to rectification under article 16 of general data protection regulation (gdpr) as the controller corrects inaccurate data like a missing zip code without undue delay.

Explain why a GDPR data controller may refuse erasure when processing is necessary for exercising the right of freedom of expression and information, per Article 17(3), including related exemptions.

Explore the GDPR article 17 right to erasure and when a data controller must delete personal data—unlawful processing, no longer necessary, withdrawal of consent, or public interest or statistical purposes.

Learn how a data subject can restrict processing under Article 18 of the GDPR when contesting the accuracy of their personal data to enable the controller to verify it.

Question 65 explains which method cannot restrict processing; anonymization stops identification, making data unusable; option D is correct per recital 67.

Explain the GDPR data portability right under Article 20, enabling data subjects to obtain and transfer their personal data to another controller in a structured, machine-readable format.

Assess how the data portability right applies under the gdpr, including when processing is based on consent or contract performance, and when legitimate interests may justify processing (recital sixty-eight).

Identify data portability eligibility under the GDPR by confirming data provided by the data subject to the data controller and excluding third-party data, per article 20(1).

Explain GDPR's contract basis for processing personal data to deliver shoes; processing is lawful to meet contract obligations and may apply as a step toward forming a contract.

Examine automated decision making under GDPR article 22, with examples like loan eligibility and online credit refusals, and learn data subjects' right to avoid solely automated decisions.

Explain GDPR article 23 restrictions on data subject rights in member states. List the affected rights (articles 13–14, 15, 16, 17, 18, 20–22) and the justifications for restriction.

Review Article 24 obligations: data controllers must implement and demonstrate appropriate technical and organizational measures to ensure processing complies with data processing principles.

Identify that a data processing agreement demonstrates GDPR compliance, with codes of conduct or certification mechanisms as alternatives per articles 24, 40, and 42.

Identify measures that support data protection by design and by default, emphasizing data minimization and internal policies while noting privacy assessment is not a required measure.

Identify when two or more organizations act as joint controllers under Article 26, determining the purposes and means of processing, and explain how this relationship shapes GDPR responsibilities.

Understand when a non-union data controller must designate a written representative under GDPR article 27 for processing related to offering goods or monitoring data subjects in the union.

Clarifies that under the GDPR, a sub processor must process personal data only on the data controller's instructions, unless EU or member state law requires otherwise per Article 29.

Explore the GDPR, the history of data protection laws in the EU, and the EU institutions through section five sample questions (78–103) as you approach the course's final quiz.

Explains what records of processing activities must include under Article 30, including controller details, purposes, data subjects, recipients, transfers, and security measures, and notes that mitigation measures are not required.

Explore which records of processing activities must be kept by a data processor under GDPR article 30, clarifying that the purposes are determined by the data controller, not the processor.

Identify which factors are considered under GDPR Article 32 when implementing technical and organizational measures, and learn why the number of data subjects is not considered.

Identify that anonymization is not a technical or organisational measure under article 32, while encryption is, and note the need for regular testing and the ability to restore data promptly.

This scenario highlights a breach of transparency in data processing under gdpr when a manager accesses an employee's email inbox without consent, revealing how personal data processing should be communicated.

Implement internal controls on access to employee inboxes and apply appropriate technical and organizational measures per article 24 to prevent unauthorized access.

Assess unauthorized email access triggers GDPR penalties, detailing fines up to 20 million euros or 4% of worldwide revenue for breaches of data processing principles, consent, and data subject rights.

Examine GDPR penalties for failing to implement technical and organisational measures, including fines up to 10 million euros or two percent of worldwide revenue for data controller infringements.

Explain GDPR breach notification: data controllers must notify the supervisory authority without undue delay and within 72 hours of discovering a personal data breach, with reasons if delayed.

Explain what the GDPR notification to supervisory authorities must include, including Article 33 requirements, categories of data subjects, incident response documentation, and the data protection officer’s details and proposed measures.

Identify how retaining customer data indefinitely breaches the storage limitation principle under GDPR, illustrated by Network Inc’s data exposure incident and rapid fix.

Explore how unrestricted engineer access to customer data in a GDPR context breaches data integrity and highlights the need for internal access controls for research.

Under article 34, when a breach likely risks rights and freedoms, the controller must notify data subjects without undue delay.

Analyze GDPR breach notification requirements: clearly describe the breach, include DPO contact details, likely consequences, and proposed measures, while excluding the supervisory authority notification date.

Explain GDPR article 34 breach notification rules, identifying when data subjects must be informed without undue delay and exceptions for protective measures and disproportionate effort.

Assess the privacy implications of location-based employee monitoring, conduct a data protection impact assessment under Article 35, and involve the supervisory authority when monitoring poses high risk.

Understand when a data protection impact assessment is required under Article 35, covering systematic and automated processing, profiling, large-scale processing, and sensitive data scenarios.

Identify the elements of a data protection impact assessment, including processing operations, purposes, necessity and proportionality, and risks to data subjects’ rights; privacy by design measures should not be included.

Explore the role of the data protection officer in GDPR compliance, including when to consult the DPO and the link to data protection impact assessments under Article 35.

Identify that a data protection impact assessment indicates a higher risk if mitigation is absent, and require the data controller to consult the supervisory authority before processing under Article 36.

Identify the European Commission as the body that determines adequate protection for transfers to a third country, and note that such transfers do not require specific authorization.

Identify where to find the European Commission’s list of third countries with an adequate level of data protection for transfers on its website, per article four.

Identify safeguards for data transfers to a third country under Article 46, including binding corporate rules and standard contractual clauses; a data processing agreement is not an appropriate safeguard.

Assess how Cup Inc.'s privacy policy breaches GDPR requirements by failing to include key elements under articles 13 and 14, and identify that the policy does not meet processing notices.

Explore a GDPR quiz scenario on the data minimization principle, privacy notices, and lawful processing for marketing campaigns and surveillance in ride-sharing services.

Analyze how article 28 requires processor compliance with documented controller instructions, confidentiality, and audit assistance, while contracts may omit processing activity records.

Celebrate completing the course by reinforcing your understanding of GDPR, EU data protection history, and EU institutions, with quizzes and a practice test to solidify your knowledge.