Question 1

According to the principle of data minimization, data must be:

Options :

A : In a form which permits the identification of data subjects for no longer than is necessary.

B : Acquired only for specified, explicit, and legitimate purposes.

C : Adequate, relevant, and limited to what is necessary in relation to the purposes of processing.

D : Stored for no more than five years from the date of collection.

Answer: C

Question 2

Scenario: ChatBubble is a software company that stores personal data, including usernames, emails, and passwords. Last month, an attacker gained access to ChatBubbles system, but the personal data was encrypted, preventing unauthorized access. Should the data subjects be notified in this case?

Options :

A : Yes, the company shall communicate all incidents regarding personal data to the data subjects.

B :

No, the company is not required to notify data subjects about a data breach that affects a large number of individuals.

C :

No, the company is not required to notify data subjects when the personal data is protected with appropriate technical and organizational measures.

D : Yes, but only if the supervisory authority explicitly requests notification

Answer: C

Question 3

Under GDPR, the controller must demonstrate that data subjects have consented to the processing of their personal data, and the consent must be freely given. What is the role of the DPO in ensuring compliance with this requirement?

Options :

A :

The DPO should ensure that the controller has informed data subjects about their right to withdraw consent.

B :

The DPO should ensure that the controller has implemented procedures to provide evidence that consent has been obtained for all relevant personal data.

C :

The DPO should personally record information such as who consented, when they consented, and how consent was given

D :

The DPO should approve the legal basis for consent processing before the controller can collect personal data.

Answer: B

Question 4

Based on Article 58 of GDPR, what powers must the supervisory authority have?

Options :

A : To appoint a single DPO in a group of undertakings.

B :

To obtain access to any premises of the controller and processor, including data processing equipment.

C : To assign the tasks of the controller or the processor and monitor their implementation.

D : To approve all privacy policies before they are implemented.

Answer: B

Question 5

Scenario 3:

COR Bank is an international banking group that operates in 31 countries. It was formed as the

merger of two well-known investment banks in Germany. Their two main fields of business are retail

and investment banking. COR Bank provides innovative solutions for services such as payments, cash

management, savings, protection insurance, and real-estate services. COR Bank has a large number

of clients and transactions. Therefore, they process large information, including clients' personal dat

a. Some of the data from the application processes of COR Bank, including archived data, is operated

by Tibko, an IT services company located in Canada. To ensure compliance with the GDPR, COR Bank

and Tibko have reached a data processing agreement Based on the agreement, the purpose and

conditions of data processing are determined by COR Bank. However, Tibko is allowed to make

technical decisions for storing the data based on its own expertise. COR Bank aims to remain a

trustworthy bank and a long-term partner for its clients. Therefore, they devote special attention to

legal compliance. They started the implementation process of a GDPR compliance program in 2018.

The first step was to analyze the existing resources and procedures. Lisa was appointed as the data

protection officer (DPO). Being the information security manager of COR Bank for many years, Lisa

had knowledge of the organization's core activities. She was previously involved in most of the

processes related to information systems management and data protection. Lisa played a key role in

achieving compliance to the GDPR by advising the company regarding data protection obligations

and creating a data protection strategy. After obtaining evidence of the existing data protection

policy, Lisa proposed to adapt the policy to specific requirements of GDPR. Then, Lisa implemented

the updates of the policy within COR Bank. To ensure consistency between processes of different

departments within the organization, Lisa has constantly communicated with all heads of GDPR.

Then, Lisa implemented the updates of the policy within COR Bank. To ensure consistency between

processes of different departments within the organization, Lisa has constantly communicated with

all heads of departments. As the DPO, she had access to several departments, including HR and

Accounting Department. This assured the organization that there was a continuous cooperation

between them. The activities of some departments within COR Bank are closely related to data

protection. Therefore, considering their expertise, Lisa was advised from the top management to

take orders from the heads of those departments when taking decisions related to their field. Based

on this scenario, answer the following

Considering the GDPR's territorial scope and the data processing agreement between COR Bank and

Tibko, which of the following best describes Tibko's obligations under the GDPR?

Options :

A :

Tibko-s compliance with GDPR is limited to implementing technical safeguards for data storage, as stipulated by the data processing agreement with COR Bank.

B :

Tibko must adhere to all GDPR provisions independently, including determining the purpose of processing personal data, as a processor acting under COR Bank-s authority.

C :

Tibko is required to comply with the GDPR because it processes personal data on behalf of COR Bank, and COR Bank determines the purpose of processing under their agreement.

D : Tibko is not subject to GDPR since it is located outside the EU and only provides IT services.

Answer: C