Free PDPF Practice Test

The lost data includes a union's contact list, which implicitly reveals the trade union membership of the individuals. Under the General Data Protection Regulation (GDPR), trade union membership is classified as a 'special category of personal data' (Article 9). The unauthorized disclosure or loss of such sensitive data is considered likely to result in a high risk to the rights and freedoms of the data subjects. According to GDPR Article 34, when a personal data breach is likely to result in such a high risk, the controller (the union) must communicate the breach to the affected data subjects (the members on the contact list) without undue delay.

B. To the Union staff: This is an internal incident response procedure, not a formal external reporting obligation mandated by data protection law to protect the affected individuals.
C. To the police: Reporting to law enforcement is only necessary if a criminal act, such as theft, is suspected. The scenario describes the drive as "lost," which does not automatically imply a crime.

1. General Data Protection Regulation (EU) 2016/679, Article 34(1): "When the personal data breach is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall communicate the personal data breach to the data subject without undue delay."

2. General Data Protection Regulation (EU) 2016/679, Article 9(1): This article defines "special categories of personal data" and explicitly includes data revealing "...trade union membership...".

3. European Data Protection Board (EDPB), Guidelines 01/2021 on Examples regarding Data Breach Notification, Version 2.0 (14 January 2022): Page 15, Example 8 discusses the loss of an unencrypted USB stick containing employee data, including union affiliation. The EDPB concludes this constitutes a high risk, mandating notification to the data subjects under Article 34.

4. Article 29 Working Party, Guidelines on Personal data breach notification under Regulation 2016/679 (WP250rev.01), Section IV.B.2: This section details criteria for assessing risk, stating that a breach involving special categories of data, such as trade union membership, is a key factor indicating a likely high risk to individuals.

The principle of data minimization is explicitly defined in Article 5(1)(c) of the GDPR. It mandates that personal data must be "adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed." This means organizations must identify the minimum amount of personal data required to fulfill a specific, legitimate purpose and process only that data. It is a core principle of data protection by design and by default, ensuring that data collection is not excessive.

A. Applying the concept of least privilege relates to access control and security, which falls under the principle of integrity and confidentiality, not data minimization.
B. Limiting access rights is a security measure to ensure confidentiality (Article 5(1)(f) GDPR), not a method for minimizing the amount of data collected initially.
D. Limiting file sizes is a technical data storage practice. It does not address the legal requirement to limit the scope and volume of personal data being processed.

1. General Data Protection Regulation (GDPR) - Regulation (EU) 2016/679:

Article 5(1)(c): "Personal data shall be: ... (c) adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (‘data minimisation’);" This is the direct legal definition supporting answer C.

2. Information Commissioner's Office (ICO) - Guide to the GDPR:

Principle (c): Data minimisation, Section: "You must ensure the personal data you are processing is: adequate – sufficient to properly fulfil your stated purpose; relevant – has a rational link to that purpose; and limited to what is necessary – you do not hold more than you need for that purpose." This guidance directly elaborates on the definition in Article 5(1)(c).

3. Voigt, P., & von dem Bussche, A. (2017). The EU General Data Protection Regulation (GDPR): A Practical Guide. Springer International Publishing.

Page 100, Section 4.2.3.3: "The principle of data minimisation (Art. 5(1)(c) GDPR) requires that personal data must be adequate, relevant and limited to what is necessary for the purposes of the processing." This academic text confirms the definition and its practical application. (DOI: https://doi.org/10.1007/978-3-319-57959-7)

According to Article 4(20) of the GDPR, Binding Corporate Rules (BCRs) are defined as "personal data protection policies which are adhered to by a controller or processor... for transfers... of personal data to a controller or processor in one or more third countries within a group of undertakings, or group of enterprises engaged in a joint economic activity." They are essentially a corporate code of conduct or internal rulebook that allows multinational companies to transfer personal data from their EEA-based entities to their non-EEA entities while providing adequate safeguards for the data. These rules must be approved by a competent data protection authority as per the consistency mechanism outlined in Article 47.

A. This describes an adequacy decision, which is a finding by the European Commission under Article 45 of the GDPR, not Binding Corporate Rules.
C. This describes the function of any appropriate safeguard under Article 46 of the GDPR (like Standard Contractual Clauses), but it is not the definition of what BCRs are.
D. BCRs under the GDPR specifically legitimize transfers from the EEA to non-EEA countries within a group, not transfers exclusively between non-EEA countries.

1. General Data Protection Regulation (EU) 2016/679:

Article 4(20): Provides the official definition of 'binding corporate rules'.

Article 47(1): States that a competent supervisory authority shall approve binding corporate rules provided that they are legally binding, applied by every member of the group, and confer enforceable rights on data subjects.

2. European Data Protection Board (EDPB) / Article 29 Working Party (WP29):

Working Paper WP259 rev.01, "Working Document setting up a table with the elements and principles to be found in Binding Corporate Rules," adopted on 11 April 2018. Section 1, Introduction, describes BCRs as "internal rules (such as a Code of Conduct) adopted by a multinational group of companies... which define its global policy with regard to the international transfers of personal data from a group’s entity located in the EEA to a group’s entities located in other parts of the world."

According to Article 4(7) of the General Data Protection Regulation (GDPR), a 'controller' is defined as the natural or legal person, public authority, agency, or other body that, either alone or jointly with others, determines the purposes and means of the processing of personal data. The key elements are the decision-making power over why (the purposes) and how (the means) personal data is processed. This entity holds the primary responsibility for ensuring compliance with data protection principles.

A. This describes a Supervisory Authority (Data Protection Authority), as defined in GDPR Article 4(21) and Article 51, not a controller.
C. This describes an entity acting unlawfully. The GDPR defines legitimate roles for data processing, not unauthorized ones.
D. This is the definition of a 'processor' under GDPR Article 4(8), which acts on behalf of and follows the instructions of the controller.

1. Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation), 27 April 2016.

Article 4, Paragraph 7: "‘controller’ means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data..."

Article 4, Paragraph 8: Defines 'processor' as the entity which "processes personal data on behalf of the controller".

2. European Data Protection Board (EDPB), Guidelines 07/2020 on the concepts of controller and processor in the GDPR, Version 2.1, 7 July 2021.

Page 11, Paragraph 22: "The definition of controller is laid down in Article 4(7) GDPR... The controller is the entity that determines the purposes and means of the processing of personal data." This document extensively clarifies the definition and its practical application.

The company's action of segmenting customers by gender to send a customized newsletter is a form of profiling for direct marketing purposes. Under the General Data Protection Regulation (GDPR), Article 21(2) grants data subjects an absolute right to object at any time to the processing of their personal data for such marketing. This right is unconditional and, once exercised, the personal data can no longer be processed for these purposes. The definition of profiling in Article 4(4) includes using personal data to evaluate or predict personal preferences and interests, which directly applies to creating a customized newsletter based on a personal characteristic like gender.

A. The right to rectification: This right applies when personal data is inaccurate or incomplete, which is not the issue described in the scenario.
B. The right to compensation: This right is contingent upon suffering material or non-material damage from a GDPR infringement, not a primary right against a proposed processing activity.

1. Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (General Data Protection Regulation), Article 21, Paragraph 2: "Where personal data are processed for direct marketing purposes, the data subject shall have the right to object at any time to processing of personal data concerning him or her for such marketing, which includes profiling to the extent that it is related to such direct marketing."

2. Regulation (EU) 2016/679 (General Data Protection Regulation), Article 4, Paragraph 4: Defines 'profiling' as "any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person's... personal preferences, interests...".

3. Bygrave, L. A. (2020). Article 21 Right to object. In C. Kuner, L. A. Bygrave, C. Docksey, & R. Drechsler (Eds.), The EU General Data Protection Regulation (GDPR): A Commentary (pp. 519-533). Oxford University Press. This commentary confirms that the right to object to processing for direct marketing purposes, including related profiling, is absolute (Section 21.21).

Data Lifecycle Management (DLM) is the process of managing data throughout its entire lifespan, from creation or collection to its eventual archival or destruction. This management of the data's flow is fundamentally linked to data protection. It provides the necessary framework to apply core data protection principles, such as purpose limitation, data minimization, and storage limitation, at each specific stage of the lifecycle. By controlling where data is, how it is used, and when it is deleted, an organization can effectively implement security measures and ensure compliance with regulations like the GDPR.

A. Profiling is a specific data processing activity that uses personal data to evaluate certain aspects of an individual; it is not the function of DLM itself.
C. This describes the process of risk management or a Data Protection Impact Assessment (DPIA), which, while related, is a distinct discipline from managing the data lifecycle.

1. General Data Protection Regulation (GDPR): Article 5(1)(e) establishes the principle of 'storage limitation,' stating personal data should be kept "for no longer than is necessary for the purposes for which the personal data are processed." This principle inherently requires a data lifecycle management process to identify and manage the end-of-life stage for data, directly linking DLM to a core data protection requirement. (Source: Regulation (EU) 2016/679 of the European Parliament and of the Council, Article 5(1)(e)).

2. Stanford University - Data Governance: The university's Information Security Office defines the data lifecycle with stages including create, store, use, share, archive, and destroy. It states, "Understanding this lifecycle allows you to better manage, protect, and preserve the data at each phase." This illustrates the foundational role of managing the data's journey (flow) in its protection. (Source: Stanford University, Data Lifecycle, University IT, Information Security Office).

3. ENISA (European Union Agency for Cybersecurity): In its guidelines, ENISA emphasizes implementing security measures throughout the data lifecycle. It notes, "Security measures should be implemented throughout the entire lifecycle of the personal data processing, from the initial design of the processing operation until its very end (e.g. the deletion of the data)." This confirms that managing the data's lifecycle is the vehicle for applying data protection controls. (Source: ENISA, Guidelines for SMEs on the security of personal data processing, December 2016, Section 3.1, p. 9).

The main purpose of HTTP cookies is to enable state management for the otherwise stateless HTTP protocol. They are small pieces of data sent from a website and stored on the user's computer by the web browser. Their primary functions are session management (e.g., keeping a user logged in), personalization (e.g., remembering user preferences like language or theme), and tracking user activity on a specific site. Option A accurately summarizes these core, intended functions that are fundamental to modern web application usability.

B. Browser history is a core function managed by the web browser application itself, not by cookies, which are site-specific data files.
C. While third-party cookies are widely used for tracking to serve targeted ads, this is a secondary application, not the fundamental or main purpose for which they were created.
D. Cookies are passive text files and cannot execute code or "infect" a computer; this description applies to malware or adware, not standard cookies.

1. Internet Engineering Task Force (IETF) RFC 6265, "HTTP State Management Mechanism": The abstract and Section 1 ("Introduction") state that cookies are used by servers to store state at user agents, enabling session maintenance. It explicitly lists common uses as "authentication, personalization (such as user preferences), and tracking." This directly supports the functions listed in option A as primary purposes. (Source: RFC 6265, Abstract & Section 1, April 2011).

2. Mozilla Developer Network (MDN) Web Docs, "HTTP Cookies": This official documentation outlines the main purposes of cookies. It lists "Session management" (Logins, shopping carts, etc.), "Personalization" (User preferences, themes), and "Tracking" as the three primary uses. The first two align perfectly with the answer. (Source: MDN Web Docs, "HTTP Cookies", Section: "Purpose of cookies").

3. Stanford University, CS 142 Courseware, "Sessions and Cookies": Lecture notes explain that cookies are the primary mechanism for implementing sessions on the web. They are used to "remember information about a user between requests," such as login status and user-specific settings, which directly corresponds to identifying the user and their preferences. (Source: Stanford CS142, Lecture Notes 08, "Sessions and Cookies", Slide 11-15).

The General Data Protection Regulation (GDPR) establishes the principle of accountability in Article 5(2). This principle explicitly states, "The controller shall be responsible for, and be able to demonstrate compliance with" the data protection principles. Furthermore, Article 24(1) mandates that the controller must implement appropriate measures to ensure and demonstrate that processing is performed in accordance with the Regulation. The controller determines the purposes and means of processing, and therefore holds the primary and ultimate responsibility for ensuring the entire processing activity is lawful and for demonstrating this compliance to supervisory authorities.

A. The data protection officer (DPO) advises the controller/processor and monitors compliance; they are not personally or ultimately responsible for the organization's compliance.
B. The supervisory authority is the independent public body responsible for monitoring the application of the GDPR and enforcing it, not for an organization's compliance.
C. While a processor has direct legal obligations under the GDPR, the controller retains ultimate responsibility for the processing and must ensure the processor provides sufficient guarantees.

1. Regulation (EU) 2016/679 (General Data Protection Regulation). Official Journal of the European Union, L 119/1.

Article 5(2): "The controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1 (‘accountability’)."

Article 24(1): "Taking into account the nature, scope, context and purposes of processing... the controller shall implement appropriate technical and organisational measures to ensure and to be able to demonstrate that processing is performed in accordance with this Regulation."

Article 4(7): Defines the 'controller' as the entity which "determines the purposes and means of the processing of personal data."

2. European Data Protection Board (EDPB). (2021). Guidelines 07/2020 on the concepts of controller and processor in the GDPR, Version 2.1.

Paragraph 15: "The controller is the entity that has the decision-making power with respect to the processing... This responsibility comes with the role of controller."

Paragraph 36: "The controller is responsible for compliance with all data protection principles set out in Article 5 GDPR... The controller must also be able to demonstrate compliance with the data protection principles (accountability)."

The General Data Protection Regulation (GDPR), despite being a regulation with direct effect in all EU Member States, contains numerous "opening clauses." These clauses explicitly allow or require Member States to introduce more specific national provisions to adapt the application of the GDPR's rules to their national context. This legislative flexibility allows for national particularities in areas such as processing in the context of employment (Article 88), setting the age of consent for information society services (Article 8), and processing special categories of personal data for reasons of substantial public interest (Article 9). Therefore, approving national provisions is a key function provided for Member States.

B. This obligation is already mandated directly by Article 34 of the GDPR for high-risk breaches; it is not a provision left for Member States to create.
C. The power to conduct audits is a core investigative power granted directly to the national Supervisory Authorities by Article 58(1)(b) of the GDPR.
D. The power to impose administrative fines is a core corrective power granted directly to the national Supervisory Authorities by Articles 58(2)(i) and 83 of the GDPR.

1. Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (General Data Protection Regulation). Article 88, "Processing in the context of employment," states: "Member States may, by law or by collective agreements, provide for more specific rules to ensure the protection of the rights and freedoms in respect of the processing of employees' personal data..." This exemplifies an opening clause allowing for national provisions.

2. Regulation (EU) 2016/679 (GDPR). Article 8, "Conditions applicable to child's consent in relation to information society services," paragraph 1, allows Member States to "provide by law for a lower age for those purposes provided that such lower age is not below 13 years."

3. Regulation (EU) 2016/679 (GDPR). Article 34, "Communication of a personal data breach to the data subject," establishes the controller's duty to notify the data subject directly, not as an option for Member States to enforce.

4. Regulation (EU) 2016/679 (GDPR). Article 58, "Powers," paragraph 1(b) grants Supervisory Authorities the power "to carry out investigations in the form of data protection audits," and paragraph 2(i) grants the power "to impose an administrative fine pursuant to Article 83." These are not provisions made by Member States but powers granted by the GDPR itself.

After the initial notification to the supervisory authority, which must be done within 72 hours, the controller has an ongoing obligation to investigate the breach fully. A critical component of this investigation is to assess the level of risk posed to the rights and freedoms of the affected individuals. Determining whether sensitive (special category) data has been accessed is fundamental to this risk assessment. The outcome of this analysis directly informs the controller's next legal obligation under GDPR Article 34: whether the breach is likely to result in a high risk that necessitates notifying the data subjects themselves.

A. Contact the DPO for formal notification to the Supervisory Authority. This action is out of sequence. The question states the supervisory authority has already been notified, and the DPO should have been involved from the moment the breach was discovered.
C. Register a Police Report at the cybercrime station. While potentially advisable if a crime has occurred, this is not a mandatory first step under data protection law. The primary obligation is to manage the data protection implications.
D. Notify data subjects that have been subject to a security breach. This action is premature. The decision to notify data subjects depends on a risk assessment, which must first determine if the breach is "likely to result in a high risk."

1. General Data Protection Regulation (EU) 2016/679, Article 34(1): "When the personal data breach is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall communicate the personal data breach to the data subject without undue delay." This establishes that a risk assessment must precede notification to data subjects.

2. European Data Protection Board (EDPB), Guidelines 01/2021 on Examples regarding Data Breach Notification, Version 2.0 (14 January 2022), p. 6, para. 14: "In order to determine the level of risk, the controller should conduct an objective assessment, based on a number of factors... For example, the type of breach, the nature, sensitivity, and volume of personal data..." This confirms that analyzing the sensitivity of the data is a core part of the risk assessment process.

3. General Data Protection Regulation (EU) 2016/679, Article 33(4): "The controller shall document any personal data breaches, comprising the facts relating to the personal data breach, its effects and the remedial action taken." This implies a continuous process of investigation and analysis following the initial discovery and notification.