GDPR Practice Questions

Under Article 39(1)(c) of GDPR, the DPO advises on the necessity of conducting a DPIA but does not

conduct it themselves. The controller is responsible for carrying out the DPIA.

Option B is correct because the DPO must determine whether a DPIA is required and provide

recommendations.

Option A is incorrect because conducting the DPIA is the responsibility of the controller, not the DPO.

Option C is incorrect because while the DPO can assist, DPIA documentation is the controller’s duty.

Option D is incorrect because DPOs advise but do not approve or eliminate all risks—risk

management remains the responsibility of the controller.

Reference:

GDPR Article 39(1)(c) (DPO advises on DPIA necessity)

Recital 97 (DPOs provide oversight, not execution)

Under Article 35(3)(b) of GDPR, a DPIA is required for large-scale processing of sensitive data,

including medical research on vulnerable individuals.

Option A is correct because medical data and research involving vulnerable individuals require a

DPIA.

Option B is incorrect because encryption does not eliminate the need for a DPIA if the processing

poses high risks.

Option C is incorrect because a general risk assessment does not replace a DPIA under Article 35.

Option D is incorrect because retention period is not a deciding factor for DPIA necessity.

Reference:

GDPR Article 35(3)(b) (DPIA for special category data)

Recital 91 (Risks to fundamental rights require DPIAs)

According to GDPR Recital 26, anonymization permanently removes any possibility of re-

identification, making it irreversible. Pseudonymization, as defined in Article 4(5), is reversible if the

correct key or additional information is available. Pseudonymization still qualifies as personal data

under GDPR, whereas anonymized data falls outside the scope of GDPR.

Under Article 35(11) of GDPR, controllers must reassess DPIAs regularly to account for changing risks

in processing activities like CCTV surveillance.

Option D is correct because CCTV monitoring poses an ongoing risk, requiring periodic DPIA reviews.

Option A is incorrect because regular DPIA reviews are required, even if the data processing remains

the same.

Option B is incorrect because transparency is a key principle of GDPR, and displaying information

does not breach GDPR.

Option C is incorrect because data processors can process CCTV data as long as there is a processing

agreement (Article 28).

Reference:

GDPR Article 35(11) (Periodic DPIA review)

Recital 90 (Regular assessment of risks)

Under Article 7(1) of GDPR, controllers must be able to demonstrate that the data subject has given

consent. The DPO advises on ensuring these procedures are in place but does not collect or approve

consent directly.

Option B is correct because the DPO must verify that consent records exist and meet GDPR

standards.

Option A is incorrect because informing data subjects about withdrawal rights is the controller’s duty,

not the DPO’s.

Option C is incorrect because the DPO does not personally maintain consent logs.

Option D is incorrect because DPOs do not approve legal bases for processing—this is the controller’s

responsibility.

Reference:

GDPR Article 7(1) (Controller must demonstrate valid consent)

GDPR Article 39(1)(b) (DPO ensures compliance with data protection obligations)

GDPR applies to any organization that processes personal data of individuals within the European

Economic Area (EEA), regardless of the organization's location. Since MED is based in Norway, which

is an EEA country, and processes personal health data, it must comply with GDPR.

Option A is correct because GDPR applies to all controllers and processors within the EEA. Option B is

misleading because while cloud-based software is relevant, the primary reason GDPR applies is

MED’s processing of personal data. Option C is incorrect because EFTA states (including Norway) are

subject to GDPR. Option D is incorrect because GDPR applies to all personal data processing in the

EEA.

Reference:

GDPR Article 3 (Territorial Scope)

Recital 22 (GDPR applies to EEA countries)

Under Article 30(1) of GDPR, controllers and processors must document details such as data

processing purposes, categories of data subjects, and security measures, but do not need to store

detailed transaction amounts or items purchased unless required for compliance.

Option D is correct because detailed transactional information is not a mandatory requirement in the

processing records.

Option A is incorrect because security measures must be documented.

Option B is incorrect because data retention periods must be included in records.

Option C is incorrect because cross-border data transfers must be documented.

Reference:

GDPR Article 30(1)(f) (Controllers must document data transfers)

Recital 82 (Record-keeping requirements for accountability)

GDPR Article 32(1)(b) emphasizes implementing access controls to ensure data security. Reviewing

and restricting account permissions using the principle of least privilege (PoLP) helps prevent

unauthorized access. Shared accounts (option C) increase security risks, and using cloud computing

(option B) does not directly address access control vulnerabilities.

GDPR Article 25 requires controllers to implement appropriate measures ensuring data protection.

This includes transparency measures that allow data subjects to monitor the processing of their

personal data, fulfilling their rights under Articles 12-22.

Under Article 30 of GDPR, controllers and processors must maintain a record of processing activities

(ROPA). Whenever changes occur in the way personal data is processed (such as a transfer to cloud

storage), the DPO must ensure these changes are recorded in the processing register.

Option B is correct because the DPO must ensure the data processing register is updated to reflect

the new storage method.

Option A is incorrect because storage changes do not require new consent unless the purpose of

processing has changed.

Option C is incorrect because while assessing security measures is important, it is not the primary

duty related to the data processing register.

Option D is incorrect because not all processing changes require notifying the supervisory authority

unless they introduce high risks without proper safeguards.

Reference:

GDPR Article 30(1)(g) (Controllers must maintain updated processing records)

Recital 82 (Controllers should document changes in processing activities)