Scenario: A clinical research organization collects and processes sensitive personal data of individuals for medical research purposes. The data is…

Under Article 35(3)(b) of GDPR, a DPIA is required for large-scale processing of sensitive data,

including medical research on vulnerable individuals.

Option A is correct because medical data and research involving vulnerable individuals require a

DPIA.

Option B is incorrect because encryption does not eliminate the need for a DPIA if the processing

poses high risks.

Option C is incorrect because a general risk assessment does not replace a DPIA under Article 35.

Option D is incorrect because retention period is not a deciding factor for DPIA necessity.

Reference:

GDPR Article 35(3)(b) (DPIA for special category data)

Recital 91 (Risks to fundamental rights require DPIAs)