EXIN Privacy and Data Protection Foundation (PDPF) Free Practice Test

Question 1

What is the main purpose of the General Data Protection Regulation (GDPR)?

A. Protecting the data of everyone in Europe.

B. Protect the data of everyone in the world.

C. Protect data of data subjects located in the European Economic Area (EEA), regardless of the country of processing.

D. Protect confidential business data.

Correct Answer: C

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 2

What is a description of data protection by design and by default?

A. An approach that implements data protection from the start (Correct)

B. Not holding more data than is strictly required for processing

C. An indication of timeframes if processing relates to erasure

D. Data may only be collected for explicit and legitimate purposes

Correct Answer: A

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 3

Subcontracting treatment is regulated by contract or other regulatory act under Union or Member State law, which links the processor to the controller.
What this contract or other regulatory act stipulates?

A. A process for testing, assessing and regularly evaluating the effectiveness of technical and organizational measures to ensure safe treatment.

B. The processor assists the driver through technical and organizational measures to enable it to fulfill its obligation to respond to requests from data subjects.

C. The description of categories of data subjects and categories of personal data

D. The purpose of data processing

Correct Answer: B

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 4

A controller discovers that a data subject, who had given consent for the processing of his data, has passed away. What this implies for data processing according to the General Data Protection Regulation (GDPR)?

A. The controller can process the data of a deceased person as long as it anonymizes the data.

B. The data can only be processed by the controller respecting the consent provided by the holder.

C. The controller must delete the data of the holder, since with the death of the holder the consent is automatically revoked.

D. With the death of the data owner, the controller can continue processing the data, as they are no longer under the GDPR.

Correct Answer: D

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 5

A security breach has occurred in an information system that also holds personal dat a. According to the GDPR, what is the very first thing the controller must do?

A. Assess whether personal data of a sensitive nature has or may have been unlawfully processed

B. Report the breach immediately to all data subjects and the relevant supervisory authority

C. Ascertain whether the breach may have resulted in loss or unlawful processing of personal data

D. Assess the risk of adverse effects to the data subjects using a data protection impact assessment (DPIA)

Correct Answer: C

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 6

The Control Authority may impose fines on organizations that are not meeting the mandatory requirements of the General Data Protection Regulation (GDPR).

A. False

B. True

Correct Answer: B

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 7

What does the GDPR concept of 'binding corporate rules' (BCR) imply?

A. A set of rules used by a group of enterprises concerning personal data protection in international transfers

B. A commission decision on the safety of data transfer to a third country

C. Rules covering data transfers between third countries

D. Measures to compensate for the lack of data protection in a third country

Correct Answer: A

Question 8

To plan the amount of parking space needed, a local government monitors and saves the license plate number of every car that enters and leaves the city center. They have obtained permission to collect data on the number of cars present in the city center. By comparing the license plate time of entry and exit the number of cars present every moment of each day is calculated. Each month a report is created detailing the average number of cars in the city center at specific moments for every day of the week. At every entrance to the city center, a billboard clearly states what data is collected by whom, the purpose of the processing and the fact that the license plate numbers are saved securely for up to two years, because the measurements will be repeated next year. Which of the basic principles for legitimate processing of personal data is violated in this scenario?

A. Personal data are kept in a form permitting identification of data subjects for no longer than is necessary.

B. Personal data are processed in a manner that ensures appropriate security of the personal data.

C. Personal data are collected for specified, explicit and legitimate purposes and not further processed.

D. Personal data are processed in a transparent manner in relation to the data subject

Correct Answer: A

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 9

A controller wants to switch processors. What is necessary to review before making this change, so that it remains GDPR compliant?

A. Require the old processor to port the data.

B. Verify that the new processor has sufficient security guarantees.

C. Require the old processor to erase data.

D. The matrix location of this new processor.

Correct Answer: B

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 10

What is the definition of Supervisory Authority according to the GDPR?

A. Individual or legal entity that, individually or in conjunction with others, determines the purposes and means of processing personal data.

B. Individual or legal entity that is not authorized to process personal data

C. An independent public authority created by a Member State.

D. Individual or legal entity processing personal data on behalf of the person responsible for processing personal data.

Correct Answer: C

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Welcome to TestSimulate

EXIN Privacy and Data Protection Foundation (PDPF) Free Practice Test