Scenario: PickFood is an online food delivery service that allows customers to order food online and pay by credit card. The payment service is…

Under Article 30(1) of GDPR, controllers and processors must document details such as data

processing purposes, categories of data subjects, and security measures, but do not need to store

detailed transaction amounts or items purchased unless required for compliance.

Option D is correct because detailed transactional information is not a mandatory requirement in the

processing records.

Option A is incorrect because security measures must be documented.

Option B is incorrect because data retention periods must be included in records.

Option C is incorrect because cross-border data transfers must be documented.

Reference:

GDPR Article 30(1)(f) (Controllers must document data transfers)

Recital 82 (Record-keeping requirements for accountability)