Free GDPR Practice Test

According to Article 39(1)(c) of the GDPR, a key task of the Data Protection Officer (DPO) is "to provide advice where requested as regards the data protection impact assessment and monitor its performance pursuant to Article 35." The European Data Protection Board (EDPB) guidelines clarify this advisory role, stating that the controller should seek the DPO's advice on whether or not a DPIA is necessary. While the ultimate responsibility for the DPIA lies with the controller, the DPO's expert advice on its necessity, methodology, and risk mitigation is a fundamental part of the process.

A. Conduct the DPIA. This is incorrect. The controller is responsible for ensuring and carrying out the DPIA, not the DPO. The DPO's role is to advise and monitor.
C. Record the DPIA outcomes. This is an administrative task for which the controller is ultimately responsible. The DPO monitors performance and documentation but does not own the recording process.
D. Approve the DPIA and ensure all risks are eliminated. The DPO advises but does not have approval authority; that rests with the controller. Furthermore, a DPIA aims to mitigate risks to an acceptable level, not necessarily eliminate them entirely.

1. General Data Protection Regulation (EU) 2016/679:

Article 35(2): "The controller shall seek the advice of the data protection officer, where designated, when carrying out a data protection impact assessment."

Article 39(1)(c): Specifies the DPO's task is "to provide advice where requested as regards the data protection impact assessment and monitor its performance pursuant to Article 35."

2. European Data Protection Board (EDPB) - formerly Article 29 Working Party, Guidelines on Data Protection Impact Assessment (DPIA) and determining whether processing is “likely to result in a high risk” for the purposes of Regulation 2016/679, WP248 rev.01, Adopted on 4 April 2017, as last Revised and Adopted on 4 October 2017.

Section III.B, Page 10: "The controller should seek the advice of the DPO, who should help the controller to carry out the DPIA. This advice could cover... whether or not to carry out a DPIA..."

3. European Data Protection Board (EDPB) - formerly Article 29 Working Party, Guidelines on Data Protection Officers ('DPOs'), WP243 rev.01, Adopted on 13 December 2016, as last Revised and Adopted on 5 April 2017.

Section 3.3, Page 16: "The controller should seek the DPO’s advice on the following issues, amongst others: whether or not to carry out a DPIA; what methodology to follow when carrying out a DPIA..."

4. University of Groningen, Courseware on GDPR, "The Role of the Data Protection Officer."

The course materials emphasize the DPO's advisory and monitoring capacity as distinct from the controller's decision-making and implementation responsibilities, citing the EDPB guidelines on the DPO's role in advising on the necessity of a DPIA.

A Data Protection Impact Assessment (DPIA) is mandatory under GDPR Article 35 when processing is "likely to result in a high risk to the rights and freedoms of natural persons." The scenario involves two key criteria that indicate high risk: the processing of special categories of personal data (sensitive health data) and data concerning vulnerable data subjects (participants in clinical research). The European Data Protection Board (EDPB) guidelines specify that when two or more such criteria are met, a DPIA is required. The purpose of the DPIA is to systematically analyze the processing and implement measures to mitigate the identified high risks.

B. Encryption is a security measure to mitigate risk, but its presence does not eliminate the legal obligation to conduct a DPIA when the processing is inherently high-risk.
C. A general risk assessment may identify the need for a DPIA, but it is not a substitute for the specific, legally mandated DPIA process required by GDPR for high-risk processing.
D. The requirement for a DPIA is based on the nature and risk of the processing, not on a specific data retention period. There is no such five-year rule in the GDPR.

1. Regulation (EU) 2016/679 (General Data Protection Regulation), Article 35(1) and Article 35(3)(b). Article 35(1) establishes the requirement for a DPIA for high-risk processing. Article 35(3)(b) explicitly lists "processing on a large scale of special categories of data referred to in Article 9(1)" as a case requiring a DPIA.

2. European Data Protection Board (formerly Article 29 Working Party), "Guidelines on Data Protection Impact Assessment (DPIA) and determining whether processing is 'likely to result in a high risk' for the purposes of Regulation 2016/679," WP248 rev.01, adopted on 4 October 2017. Section III.A and Annex 2 list the criteria for high-risk processing, which include "sensitive data" (Criterion 3) and "data concerning vulnerable data subjects" (Criterion 4). The guidelines state, "As a rule of thumb, a processing operation meeting two criteria would require a DPIA to be carried out."

3. KU Leuven Centre for IT & IP Law (CiTiP), "The data protection impact assessment: A tool for accountability?", Working Paper, 2018. This academic paper discusses the role of DPIAs, noting their mandatory nature for processing operations involving sensitive data and vulnerable persons, such as in health research, to ensure accountability and risk management. (See Section 3, "When is a DPIA required?").

This statement accurately reflects the core distinction under the GDPR. Anonymization is a process of data sanitization that results in the irreversible removal of any information that could identify an individual. As stated in Recital 26 of the GDPR, once data is truly anonymized, it is no longer considered personal data and falls outside the Regulation's scope. Conversely, pseudonymization, as defined in Article 4(5), replaces direct identifiers with pseudonyms. The process is reversible because the original data can be re-linked to an individual using "additional information" that is kept separately and securely. Therefore, pseudonymized data remains personal data and is subject to the GDPR.

A. This option incorrectly reverses the definitions; anonymization is irreversible, while pseudonymization is reversible with additional information.
C. This option describes specific techniques (data masking and adding noise) rather than the fundamental, defining principles of anonymization and pseudonymization under the GDPR.

1. General Data Protection Regulation (EU) 2016/679, Article 4(5): Defines 'pseudonymisation' as "the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person". This supports the reversibility aspect of pseudonymization.

2. General Data Protection Regulation (EU) 2016/679, Recital 26: States, "The principles of data protection should therefore not apply to anonymous information, namely information which does not relate to an identified or identifiable natural person or to personal data rendered anonymous in such a manner that the data subject is not or no longer identifiable." This confirms that anonymization results in data that cannot be attributed to an individual.

3. Article 29 Data Protection Working Party, Opinion 05/2014 on Anonymisation Techniques, WP216, Page 20: "Pseudonymisation is a useful security measure, but it is not an anonymisation method. This is because pseudonymised data are still personal data... and therefore fall within the scope of the data protection framework." This document explicitly distinguishes the two concepts, confirming pseudonymization is not true anonymization because re-identification is possible.

A Data Protection Impact Assessment (DPIA) is mandatory under GDPR Article 35 when processing is "likely to result in a high risk to the rights and freedoms of natural persons." The installation of a CCTV system across a network of 150 buses to continuously monitor a large number of passengers and employees falls directly under the criteria specified in Article 35(3)(c): "a systematic monitoring of a publicly accessible area on a large scale." A bus network is considered a publicly accessible area in this context, and the scale of the operation (150 buses, large passenger numbers) necessitates a DPIA to assess and mitigate the inherent risks to privacy.

B. This is incorrect because the primary trigger for the DPIA is the large-scale systematic monitoring itself, not necessarily an automated evaluation of personal aspects for decision-making (like profiling), which is a different criterion under Article 35(3)(a).
C. This is incorrect. The systematic, large-scale surveillance of individuals, including the recording of images and sound, is explicitly considered a type of processing that is likely to result in a high risk to individuals' rights and freedoms.
D. This is incorrect. There is no automatic exemption from GDPR requirements for CCTV systems used for security. The purpose of processing is relevant for establishing a legal basis but does not remove the obligation to comply with the regulation, including conducting a DPIA when thresholds are met.

1. General Data Protection Regulation (EU) 2016/679, Article 35, "Data protection impact assessment."

Section 1: States that a DPIA is required for processing likely to result in a high risk.

Section 3(c): Explicitly mandates a DPIA for "a systematic monitoring of a publicly accessible area on a large scale." This directly applies to the Bus Spot scenario.

2. Article 29 Data Protection Working Party (endorsed by the European Data Protection Board), "Guidelines on Data Protection Impact Assessment (DPIA) and determining whether processing is 'likely to result in a high risk' for the purposes of Regulation 2016/679," WP 248 rev.01, 4 October 2017.

Page 10, Section IV.A, Criterion 7 "Systematic monitoring": This criterion is listed as a key factor in determining if a DPIA is needed. The document clarifies that "systematic monitoring of a publicly accessible area" is an example of processing that requires a DPIA. The Bus Spot case is a clear example of this.

3. Information Commissioner's Office (ICO), "Data protection impact assessments." (The ICO is the UK's supervisory authority, and its guidance is highly respected and aligned with EDPB principles).

Section "When do we need to do a DPIA?": The ICO provides a list of processing operations that require a DPIA. This list includes "using technology to systematically monitor people in a public place on a large scale, for example CCTV." This directly supports the reasoning for the correct answer.

The General Data Protection Regulation (GDPR) in Article 39(1)(b) tasks the Data Protection Officer (DPO) with monitoring compliance with the regulation. A key obligation for the controller, outlined in Article 7(1), is the ability to "demonstrate that the data subject has consented." Therefore, the DPO's role is not to perform the operational task of recording consent but to monitor and verify that the controller has implemented adequate systems and procedures to meet this evidentiary requirement. This includes ensuring processes are in place to log who consented, when, how, and what information was provided, thereby fulfilling the controller's accountability principle.

A. While ensuring data subjects are informed of their right to withdraw is a valid compliance check, it is a specific part of the broader requirement to demonstrate valid consent, which is better encapsulated by option B.
C. This describes an operational task. The controller is responsible for the day-to-day recording of consent; the DPO's role is to advise and monitor these activities, not execute them personally.
D. The DPO advises the controller on legal compliance but does not have formal approval or veto power. The ultimate accountability for choosing and justifying the legal basis for processing rests with the controller.

1. Regulation (EU) 2016/679 (General Data Protection Regulation):

Article 7(1): "Where processing is based on consent, the controller shall be able to demonstrate that the data subject has consented to processing of his or her personal data."

Article 39(1)(b): "The data protection officer shall have at least the following tasks: ... (b) to monitor compliance with this Regulation... including the assignment of responsibilities, awareness-raising and training of staff involved in processing operations, and the related audits;"

2. Article 29 Data Protection Working Party, "Guidelines on Data Protection Officers ('DPOs')" (WP243 rev.01), 5 April 2017:

Section 3.3, Page 17: The guidelines clarify that a core task of the DPO is to "monitor compliance." This includes collecting information to identify processing activities, analyzing and checking the compliance of these activities, and advising the controller. This supports the DPO's role in ensuring procedures for demonstrating consent are in place, rather than executing them.

3. Article 29 Data Protection Working Party, "Guidelines on Consent under Regulation 2016/679" (WP259 rev.01), 10 April 2018:

Section 3.1, Page 14: This section details the controller's obligation to demonstrate consent, stating, "The controller must keep a record of consent statements... As a matter of best practice, a controller should have a way to demonstrate this, for example by documenting or logging the consent received..." The DPO's role is to monitor that the controller has implemented such a "way" or procedure.

The scenario establishes that Berc (France) and Unty (Switzerland) are joint controllers because they "jointly determined the purpose and means of processing" for the medical wrist device project. According to Article 26(1) of the GDPR, this defines a joint controller relationship. Article 26(3) of the GDPR explicitly states: "Irrespective of the terms of the arrangement... the data subject may exercise his or her rights under this Regulation in respect of and against each of the controllers." This provision ensures that data subjects are not burdened with understanding the internal allocation of responsibilities between joint controllers. They have the unequivocal right to approach either company to exercise their GDPR rights, such as the right of access, rectification, or erasure.

B. This is incorrect. It directly contradicts Article 26(3) of the GDPR, which grants data subjects the right to exercise their rights against each controller, regardless of what their internal arrangement specifies.
C. This is incorrect. Both companies are joint controllers. Unty's location in Switzerland (an adequate country) does not absolve it of its responsibilities under the joint controllership for this specific processing activity involving EU data subjects.
D. This is incorrect because option A provides the accurate answer based on the legal framework established by the GDPR for joint controllers.

1. Regulation (EU) 2016/679 (General Data Protection Regulation), Official Journal of the European Union, L 119/1.

Article 26, Paragraph 1: "Where two or more controllers jointly determine the purposes and means of processing, they shall be joint controllers."

Article 26, Paragraph 3: "Irrespective of the terms of the arrangement referred to in paragraph 1, the data subject may exercise his or her rights under this Regulation in respect of and against each of the controllers."

2. European Data Protection Board (EDPB), Guidelines 07/2020 on the concepts of controller and processor in the GDPR, Version 2.1, Adopted on 7 July 2021.

Paragraph 63 (Page 22): "Article 26(3) GDPR specifies that, irrespective of the terms of the arrangement, the data subject may exercise his or her rights under the GDPR in respect of and against each of the controllers. This is an important safeguard to ensure that the data subject can get an effective remedy."

3. De Hert, P., & Papakonstantinou, V. (2016). The new General Data Protection Regulation: Still a sound system for the protection of individuals? Computer Law & Security Review, 32(2), 179-194.

Section 3.2 (Controllers, processors and their obligations): This section discusses the clarified roles under GDPR, including joint controllership, emphasizing that the framework holds all parties involved in determining the 'why' and 'how' of processing accountable to the data subject. (DOI: https://doi.org/10.1016/j.clsr.2016.02.006)

Article 30 of the GDPR requires controllers and processors to maintain a Record of Processing Activities (RoPA). This record is a high-level, meta-document that describes data processing operations. It mandates the inclusion of categories of personal data being processed, not the actual personal data itself. Including a detailed list of every customer's transaction amount and purchased items would be a misinterpretation of Article 30. Such a practice would turn the record into a duplicate database of the processed information, which is not its purpose and would violate the principle of data minimization concerning the record itself.

A. This is incorrect. Article 30(2)(d) explicitly requires a processor's record to contain, where possible, "a general description of the technical and organisational security measures referred to in Article 32(1)."
B. This is incorrect. While the processor (PaySmart) is not required to list erasure periods in its own Article 30 record (this is an obligation for the controller under Art. 30(1)(f)), option D is more fundamentally wrong as it confuses the record about processing with the actual data being processed.
C. This is incorrect. Information about data transfers falls under the requirements of Article 30(2)(b) "the categories of processing carried out on behalf of each controller" and, if applicable, Article 30(2)(c) regarding transfers to a third country.

1. General Data Protection Regulation (EU) 2016/679, Article 30, Paragraph 2:

"Each processor...shall maintain a record of all categories of processing activities carried out on behalf of a controller, containing: ... (b) the categories of processing carried out on behalf of each controller; ... (d) where possible, a general description of the technical and organisational security measures..."

This directly supports that A and C are required elements (or categories of elements) and shows that the record is about "categories," not specific instances of data as suggested in D.

2. University of Edinburgh, "Records of Processing Activities under the UK GDPR":

"The record must be a high-level overview of the processing... It is not about listing every single piece of personal data you hold, but the categories of personal data you process..."

This academic guidance clarifies the intent of Article 30, explicitly stating that the record is a high-level overview and should contain categories of data, not the data itself, which directly refutes option D.

3. University of Cambridge, Information Compliance Office, "What are records of processing activities?":

"The record is a separate, high-level document that provides an overview of your processing of personal data... It is not your existing privacy notices, data inventories or data flow maps, although you can use these to help you create the record."

This source reinforces that the RoPA is a distinct, high-level document, separate from the actual data inventories, making option D an incorrect type of information for inclusion.

The root cause of the breach was a user account with excessive permissions ("unlimited access"). This signifies a failure in implementing the principle of least privilege. The most effective preventative measure is to address the systemic issue in access control management. Reviewing the entire lifecycle of user accounts—from creation and approval (ensuring appropriate, role-based permissions are granted) to periodic review (verifying permissions remain necessary) and timely deletion—directly remedies the control weakness. This aligns with GDPR's requirement for appropriate technical and organizational measures under Articles 25 (Data Protection by Design and by Default) and 32 (Security of Processing) to ensure the ongoing confidentiality and integrity of personal data.

B. Using cloud services is not a direct solution. The responsibility for configuring and managing user access controls remains with the organization, regardless of where the data is hosted.
C. Shared accounts are contrary to security best practices. They eliminate individual accountability, making it impossible to trace actions to a specific person, thereby increasing security risks.

1. Regulation (EU) 2016/679 (General Data Protection Regulation), Article 32(1)(b) mandates implementing measures to ensure "the ongoing confidentiality, integrity, availability and resilience of processing systems and services." A robust access control system is a fundamental measure for ensuring confidentiality and integrity.

2. Regulation (EU) 2016/679 (General Data Protection Regulation), Article 25(2) requires the controller to implement measures ensuring that "by default, personal data are not made accessible without the individual's intervention to an indefinite number of natural persons." This directly supports the principle of least privilege, which is managed through user account lifecycle controls.

3. PECB. (2022). Certified Data Protection Officer - Course Material. The module on "Security Controls for PII Protection" explicitly details User Access Management as a critical domain. It outlines the necessity of formal processes for user registration, privilege management, regular review of access rights, and de-provisioning of accounts to enforce the principle of least privilege and prevent unauthorized access.

4. Purtova, N. (2018). The law of everything. Broad concept of personal data and future of data protection. Law, Innovation and Technology, 10(1), 40-81. https://doi.org/10.1080/17579961.2018.1452176. This academic paper discusses the implementation of GDPR principles, where data protection by design (Article 25) is interpreted as requiring technical measures like granular access control systems from the very beginning of any data processing design.

The primary reason for a controller to implement appropriate technical and organizational measures is to ensure and demonstrate that processing complies with the GDPR, thereby protecting the rights and freedoms of data subjects (GDPR Art. 24, 25). While option B uses the imprecise term "monitor," it alludes to the data subject's right of access (Art. 15), which allows them to obtain information about and verify the lawfulness of the processing of their personal data. Facilitating such fundamental rights is a key objective of the measures implemented by the controller. The other options are directly contrary to the regulation's principles.

A. To enable the processor to create and improve security features This misplaces the responsibility. The controller's duty is to ensure security and compliance, not to facilitate the processor's product development.
C. To maximize the processing of personal data This directly contradicts the core GDPR principle of data minimization (Art. 5(1)(c)), which requires processing to be limited to what is necessary. ---

1. General Data Protection Regulation (EU) 2016/679, Article 24(1): "Taking into account the nature, scope, context and purposes of processing as well as the risks of varying likelihood and severity for the rights and freedoms of natural persons, the controller shall implement appropriate technical and organisational measures to ensure and to be able to demonstrate that processing is performed in accordance with this Regulation." This establishes the overarching goal is compliance and protection of rights.

2. General Data Protection Regulation (EU) 2016/679, Article 25(1): "...the controller shall... implement appropriate technical and organisational measures... which are designed to implement data-protection principles... in an effective manner and to integrate the necessary safeguards into the processing in order to meet the requirements of this Regulation and protect the rights of data subjects." This explicitly links the measures to protecting data subject rights.

3. General Data Protection Regulation (EU) 2016/679, Article 15(1): "The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data and the following information..." This article defines the right of access, which is what option B loosely describes as "monitoring."

4. Voigt, P., & Von dem Bussche, A. (2017). The EU General Data Protection Regulation (GDPR): A Practical Guide. Springer. In Chapter 10, Section 10.2, the authors discuss Article 24, explaining that the controller's measures must be aimed at operationalizing the principles of the GDPR, which centrally includes upholding the rights of data subjects. This supports the idea that facilitating rights is a key purpose of the measures.

The role of the Data Protection Officer (DPO), as outlined in Article 39 of the GDPR, includes monitoring the organization's compliance with the regulation. A key component of this is ensuring that the documentation required under Article 30, the records of processing activities (often called the data processing register or RoPA), is accurate and up-to-date. The scenario describes a new processing activity—using a storage transfer service and cloud storage. This change must be documented in the register. Therefore, the DPO's immediate and direct responsibility concerning the register is to verify that this new activity has been properly recorded.

A. Monitoring consent is a broader compliance activity. The register documents the legal basis for processing but is not the tool for monitoring the act of obtaining consent.
C. While assessing a processor's security measures is vital, the detailed measures are documented in a Data Processing Agreement (DPA), not the Article 30 register itself.
D. There is no general obligation under the GDPR to notify a supervisory authority about a change in storage methods, unless it results from a high-risk DPIA or a data breach.

1. General Data Protection Regulation (EU) 2016/679, Article 39(1)(b): "The data protection officer shall have at least the following tasks: ... (b) to monitor compliance with this Regulation ... including ... the maintenance of the documentation referred to in Article 30". This directly links the DPO's monitoring task to the data processing register.

2. General Data Protection Regulation (EU) 2016/679, Article 30(1): "Each controller and, where applicable, the controller’s representative, shall maintain a record of processing activities under its responsibility." This establishes the legal requirement for the register that the DPO must monitor. Any change in processing, such as a new storage method, necessitates an update to this record.

3. PECB. (2022). Certified Data Protection Officer Courseware. In the module covering "The Role of the Data Protection Officer," the material emphasizes that a core operational task for the DPO is to oversee the creation and continuous maintenance of the Records of Processing Activities (RoPA) to ensure it accurately reflects all current data processing operations within the organization.

4. Voigt, P., & von dem Bussche, A. (2017). The EU General Data Protection Regulation (GDPR): A Practical Guide. Springer. In Chapter 16, Section 16.3.2, "Tasks of the DPO," the authors explain that monitoring compliance includes checking the completeness and accuracy of the records of processing activities as mandated by Article 30. This is a primary tool for the DPO's oversight function. (DOI: https://doi.org/10.1007/978-3-319-57959-7)