PDPF Practice Questions

This is sensitive data, so the loss must be reported to both the responsible authority and the data

subjects.

By applying the concept of least privilege to the personal data collected, stored or otherwise

processed. Incorrect. Data minimization does not address least privilege.

By limiting access rights to staff who need the personal data for the intended processing operations.

Incorrect. This describes the concept of limiting authorization for instance to comply with the

principle of integrity and confidentiality.

By limiting file sizes, through saving all personal data that is processed in the smallest possible

format. Incorrect. Data minimization according to the GDPR is not about storage size, but about

minimalizing the use of personal data.

By limiting the personal data to what is adequate, relevant and necessary for the processing

purposes.

Correct. This is the essence of the description in the GDPR. (Literature: A, Chapter 2; GDPR Article

5(1)(c))

A decision on the safety of transferring personal data to a non-EEA country. Incorrect. This refers to

adequacy decisions.

A measure to compensate for the lack of personal data protection in a third country. Incorrect. This

refers to appropriate safeguards.

A set of agreements covering personal data transfers between non-EEA countries. Incorrect. The

GDPR does not cover agreements between non-EEA countries.

A set of approved rules on personal data protection used by a group of enterprises. Correct. BCR are

a set of rules approved by the supervisory authorities. (Literature: A, Chapter 3; GDPR Article 47)

Article 4 dealing with the GDPR Definitions says in its paragraph 7:

‘controller’ means the natural or legal person, public authority, agency or other body which, alone or

jointly with others, determines the purposes and means of the processing of personal data; where

the purposes and means of such processing are determined by Union or Member State law, the

controller or the specific criteria for its nomination may be provided for by Union or Member State

law.

The right to compensation. Incorrect. It is unlikely that all data subjects will suffer harm that must be

compensated in this scenario.

The right to object to profiling. Correct. All data subjects have a right to object to the processing of

personal data for direct marketing, including profiling. This is clearly profiling. (Literature: A, Chapter

4)

The right to rectification. Incorrect. It is unlikely that the company has incorrect data on all data

subjects, so the right to rectification does not apply.

It aims to manage the flow of data throughout the life cycle, from collection, processing, sharing,

storage and deletion.

Having the knowledge where the data travels, who is responsible, who has access, helps and a lot to

implement security measures.

There are some types of cookies, each with its own purpose.

Cookies are considered personal data, as they can identify a person. They are stored on our

computers.

You may have come across the situation of searching for a particular product on the internet and

then seeing ads for that product or similar on various websites.

Cookies are used to provide this information.

Explanation:

Controller. Correct. The controller is responsible for adequate data security measures and must be

able to demonstrate compliance with the GDPR. (Literature:A, Chapter 2)

Data protection officer (DPO). Incorrect. The DPO has expert knowledge and assists the controller or

processor to monitor internal compliance.

Processor. Incorrect. The processor is the one who processes personal data according to the

instructions of the controller. The controller remains ultimately responsible though.

Supervisory authority. Incorrect. The controller needs to demonstrate compliance with the GDPR if

requested by the supervisory authority.

Recital 10 of GDPR states:

“Regarding the processing of personal data for compliance with a legal obligation, for the

performance of a task carried out in the public interest or in the exercise of official authority vested

in the controller, Member

States should be allowed to maintain or introduce national provisions to further specify the

application of the rules of this Regulation.”

It also says: “This Regulation also provides a margin of manoeuvre for Member States to specify its

rules, including for the processing of special categories of personal data (‘sensitive data’).

However, this does not mean that Member States can approve a rule that goes against a GDPR

guideline. Note that these national provisions are measures to increase the effectiveness of the law.

Here is an example the case of Ireland where it was established that the DPO is responsible for data

breaches, something that is not provided for in the GDPR.

It is necessary to check the extent of this personal data breach, what data has been accessed and

what is the risk to his or her. Depending on this extension, in addition to notifying the supervisory

authority, it will also be mandatory to notify the owners of the breached data.