PDPF: EXIN Privacy and Data Protection Foundation

The Supervisory Authority is notified whenever an organization intends to process personal data, except for some specific situations. The Supervisory Authority keeps a publicly accessible register of these data processing operations.

What else is a legal obligation of the Supervisory Authority in reaction to such a notification?

To assess compliance with the law in all classes where sensitive personal data is processed
To assess the legitimacy of operations that involve specific risks for the data subjects
To assess the legitimacy of binding contract(s) between the controller and the data processor(s)
To give out a license for the data processing, specifying the types of personal data which are allowed

Correct answer: A

A German company wants to enter into a binding contract with a processor in the Netherlands for the processing of sensitive personal data of German data subjects. The Dutch Supervisory Authority is informed of the type of data and the aims of the processing, including the contract describing what data will be processed and what data protection procedures and practices will be in place.

According to the GDPR, what should the Dutch Supervisory Authority do in this scenario?

Report the data processing to the German Supervisory Authority and leave the supervising to them.
Supervise the processing of personal data in accordance with Dutch Law.
Supervise the processing of personal data in accordance with German Law.
The Dutch Supervisory Authority should check that adequate binding contracts are in place. The German Supervisory Authority should supervise.

Correct answer: D

For processing of personal data to be legal, a number of requirements must be fulfilled.

What is a requirement for lawful personal data processing?

A ‘code of conduct’, describing what the processing exactly entails, must be in place.
The data subject must have given consent, prior to the processing to begin.
The processing must be reported to and allowed by the Data Processing Authority
There must be a legitimate ground for the processing of personal data.

Correct answer: D

Someone regularly receives offers from a store where he purchased something five years ago. He wants the company to stop sending offers and to wipe his personal data.

Which aspect of the rights of a data subject in the General Data Protection Regulation (GDPR) requires the company to comply?

The right to erasure
The right to rectification
The right to restriction of processing
The right to withdraw consent

Correct answer: D

Explanation:

Reference: https://gdpr-info.eu/art-7-gdpr/

Important technical requirements set out in the General Data Protection Regulation (GDPR) are about data quality. One is the obligation to ensure appropriate security, including protection against unauthorized or unlawful processing.

What is another important technical requirement?

To ascertain that personal data collection is adequate, relevant and limited to what is necessary in relation to the purposes
To control that data collected for specified, explicit and legitimate purposes is not further processed for other purposes
To keep personal data accurate and up to date, ensuring that inaccurate data are erased or rectified without delay
To make sure that personal data is processed lawfully, fairly and in transparent manner in relation to the data subject

Correct answer: A

Explanation:

Reference: http://www.privacy-regulation.eu/en/article-5-principles-relating-to-processing-of-personal-data-GDPR.htm

What is the role of the one assigned the responsibility to govern the purposes and means of processing personal data within an organization, according to the GDPR?

Controller
Data Protection Officer
Data Subject
Processor

Correct answer: A

Explanation:

Reference: https://www.i-scoop.eu/gdpr/data-controller-data-controller-duties/

The GDPR states that records of processing activities must be kept by the controller. To whom must the controller make these records available, if requested?

The data processor
The Data Protection Officer
The European Commission
The supervisory authority

Correct answer: D

Explanation:

Reference: https://www.whitecase.com/publications/article/chapter-10-obligations-controllers-unlocking-eu-general-data-protection

A controller is processing personal data based on consent of the data subjects. There are no other legitimate grounds. While processing, the controller discovers that a data subject whose consent for the processing had been received, has died since.

What, according to the GDPR, will be the consequences for the controller with regard to the processing?

The controller can proceed with the processing as intended.
The controller can proceed, but only for the purposes for which consent has been given.
The controller must act as if the data subject has withdrawn consent and erase his/her data.
The controller needs to find the heir in order to require consent for the processing.

Correct answer: A

Explanation:

Reference: https://spectrum.ieee.org/telecom/internet/your-guide-to-the-gdpr

According to the GDPR, what is the main reason to consider data protection in the initial design phase?

It ensures efficiency in project phases
It ensures privacy by default
It reduces the risk of fraud
It reduces the risk of liability

Correct answer: B

When does the GDPR require data subjects consent to a cookie?

Always, because a cookie is regarded as online identifier
Never, as the EU Cookie Law does not require explicit consent
Only if the cookie contains authentication information of the data subject
Only if the cookie contains shopping basket items

Correct answer: A

Explanation:

Reference: https://eugdprcompliant.com/cookies-consent-gdpr/

Vendor:	Exin
Exam Code:	PDPF
Exam Name:	EXIN Privacy and Data Protection Foundation
Date:	Apr 15, 2020
File Size:	18 KB

Download EXIN Privacy and Data Protection Foundation.PDPF.ExamLabs.2020-04-15.21q.vcex

How to open VCEX files?

Demo Questions

Question 1

Question 2

Question 3

Question 4

Question 5

Question 6

Question 7

Question 8

Question 9

Question 10

ProfExam at a 20% markdown