PDPF Online Practice Questions and Answers

Correct Answer: A

Reference: https://eugdprcompliant.com/dpia-guidelines/

Correct Answer: D

A very repeated phrase is: "It is possible to have security without privacy, but it is not possible to have privacy without security".

Privacy is a right that should be protected, and Data Protection are the measures that will be used to achieve this protection.

Correct Answer: B

When we have a Regulation, such as the GDPR, all EU member states are obliged to follow it and have a fixed date for entry into force. The regulation is a law and Member States cannot create laws that oppose it. Unlike the Directives that set objectives to be achieved, however, each Member State is free to decide how to apply them in its country.

Important

Prior to the GDPR, there was the "95/46 / EC First Data Protection Directive (European DP)". Approved in 1995, it was already aimed to protect personal data. This directive was replaced by the GDPR.

"Article 94: 1. Directive 95/46 / EC is repealed with effect from 25 May 2018."

In the EXIN PDPF exam this is a question that is routinely asked. "What directive has been replaced by GDPR?" Answer: 95/46 / EC.

Correct Answer: B

Article 4 dealing with the GDPR Definitions says in its paragraph 7:

`controller' means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law.

Correct Answer: B

It aims to manage the flow of data throughout the life cycle, from collection, processing, sharing, storage and deletion.

Having the knowledge where the data travels, who is responsible, who has access, helps and a lot to implement security measures.

Correct Answer: A

When we talk about protection by design, we are considering data protection throughout the data lifecycle, from collection, processing, sharing, storage and deletion.

Correct Answer: C

The front line with the data holder is the Controller, see image. So, it is he who has to show compliance, who must be concerned with the legality of processing, who must implement security measures.

Correct Answer: C

It is not necessary to inform the Supervisory Authority of any violation that occurs. But every violation must be analyzed with caution and attention. It is not necessary to notify the Supervisory Authority only if it does not present risks to the data subjects.

The DPO must always be involved to guide the best strategy and action for each violation that occurs.

Article 38 legislates on the position of the data protection officer:

1. The controller and the processor shall ensure that the data protection officer is involved, properly and in a timely manner, in all issues which relate to the protection of personal data.

It is clear that the DPO ?Data Protection Officer, must be involved in the entire data processing life cycle. From its collection to its exclusion.

Correct Answer: A

In its Article 35 the GDPR legislates on the Impact assessment on data protection.

7) The assessment shall contain at least:

a) a systematic description of the envisaged processing operations and the purposes of the processing,

including, where applicable, the legitimate interest pursued by the controller;

b) an assessment of the necessity and proportionality of the processing operations in relation to the

purposes;

c) an assessment of the risks to the rights and freedoms of data subjects referred to in paragraph 1; and

d) the measures envisaged to address the risks, including safeguards, security measures and mechanisms to ensure the protection of personal data and to demonstrate compliance with this Regulation taking into account the rights and legitimate interests of data subjects and other persons concerned.

Correct Answer: A

A record of all intended processing together with the processing purpose(s) and legal justifications.

Incorrect. A record of all intended processing with the purpose(s) and legal justifications must be kept.

A record of data breaches with all relevant characteristics, including notifications. Incorrect. A record of

data breaches must be kept.

A record of notifications sent to the supervisory authority regarding processing of personal data. Correct.

Prior consultation of high-risk processing is obligatory, but there is no need for a separate record of

notifications sent.

(Literature: A, Chapter 6;GDPR Article 36(1))

A record of processors including personal data provided and the period this data can be retained.

Incorrect. A record of processors and data provided must be kept.