File Info
| Exam | EXIN Privacy and Data Protection Foundation |
| Number | PDPF |
| File Name | Exin.PDPF.TestKing.2019-10-23.24q.vcex |
| Size | 18 KB |
| Posted | Oct 23, 2019 |
| Download | Exin.PDPF.TestKing.2019-10-23.24q.vcex |
How to open VCEX & EXAM Files?
Files with VCEX & EXAM extensions can be opened by ProfExam Simulator.
Coupon: MASTEREXAM
With discount: 20%
Demo Questions
Question 1
A German company wants to enter into a binding contract with a processor in the Netherlands for the processing of sensitive personal data of German data subjects. The Dutch Supervisory Authority is informed of the type of data and the aims of the processing, including the contract describing what data will be processed and what data protection procedures and practices will be in place.
According to the GDPR, what should the Dutch Supervisory Authority do in this scenario?
- Report the data processing to the German Supervisory Authority and leave the supervising to them.
- Supervise the processing of personal data in accordance with Dutch Law.
- Supervise the processing of personal data in accordance with German Law.
- The Dutch Supervisory Authority should check that adequate binding contracts are in place. The German Supervisory Authority should supervise.
Correct answer: D
Question 2
For processing of personal data to be legal, a number of requirements must be fulfilled.
What is a requirement for lawful personal data processing?
- A ‘code of conduct’, describing what the processing exactly entails, must be in place.
- The data subject must have given consent, prior to the processing to begin.
- The processing must be reported to and allowed by the Data Processing Authority
- There must be a legitimate ground for the processing of personal data.
Correct answer: D
Question 3
Important technical requirements set out in the General Data Protection Regulation (GDPR) are about data quality. One is the obligation to ensure appropriate security, including protection against unauthorized or unlawful processing.
What is another important technical requirement?
- To ascertain that personal data collection is adequate, relevant and limited to what is necessary in relation to the purposes
- To control that data collected for specified, explicit and legitimate purposes is not further processed for other purposes
- To keep personal data accurate and up to date, ensuring that inaccurate data are erased or rectified without delay
- To make sure that personal data is processed lawfully, fairly and in transparent manner in relation to the data subject
Correct answer: A
Explanation:
Reference: http://www.privacy-regulation.eu/en/article-5-principles-relating-to-processing-of-personal-data-GDPR.htm Reference: http://www.privacy-regulation.eu/en/article-5-principles-relating-to-processing-of-personal-data-GDPR.htm
Question 4
According to the GDPR, what is a mandatory topic in a DPIA report?
- Systematic description of the fiduciary duties to ensure compliance to all relevant laws and regulations
- An assessment of the necessity and proportionality of the processing operations in relation to the purposes
- The documentation of the risks to the rights and freedoms of the data protection officer
- The measures envisaged to address the privacy compliance frameworks risks
Correct answer: B
Question 5
What is the role of the one assigned the responsibility to govern the purposes and means of processing personal data within an organization, according to the GDPR?
- Controller
- Data Protection Officer
- Data Subject
- Processor
Correct answer: A
Explanation:
Reference: https://www.i-scoop.eu/gdpr/data-controller-data-controller-duties/ Reference: https://www.i-scoop.eu/gdpr/data-controller-data-controller-duties/
Question 6
The GDPR states that records of processing activities must be kept by the controller. To whom must the controller make these records available, if requested?
- The data processor
- The Data Protection Officer
- The European Commission
- The supervisory authority
Correct answer: D
Explanation:
Reference: https://www.whitecase.com/publications/article/chapter-10-obligations-controllers-unlocking-eu-general-data-protection Reference: https://www.whitecase.com/publications/article/chapter-10-obligations-controllers-unlocking-eu-general-data-protection
Question 7
Which situation is considered a data breach according to the GDPR?
- A processor deletes personal data after his contract with the controller expired.
- A processor leaves his computer unattended, where colleagues may be able to access it.
- After a disk crash a processor restores personal data from a recent back-up.
- After processing a processor deletes personal data on instruction of the controller.
Correct answer: B
Question 8
A controller is processing personal data based on consent of the data subjects. There are no other legitimate grounds. While processing, the controller discovers that a data subject whose consent for the processing had been received, has died since.
What, according to the GDPR, will be the consequences for the controller with regard to the processing?
- The controller can proceed with the processing as intended.
- The controller can proceed, but only for the purposes for which consent has been given.
- The controller must act as if the data subject has withdrawn consent and erase his/her data.
- The controller needs to find the heir in order to require consent for the processing.
Correct answer: A
Explanation:
Reference: https://spectrum.ieee.org/telecom/internet/your-guide-to-the-gdpr Reference: https://spectrum.ieee.org/telecom/internet/your-guide-to-the-gdpr
Question 9
A personal data breach has occurred and the controller is writing a draft notification for the Supervisory Authority. The document describes the nature of the breach and its possible consequences. It also contains information on the parties that can provide additional information on the data breach to the Supervisory Authority.
What other information should the controller add?
- Information of local and national authorities that have been informed about the data breach.
- Name and contact details of the data subjects whose data may be breached.
- Suggested measures to mitigate the adverse consequences of the data breach.
- The information needed to access the personal data that has been breached.
Correct answer: C
Question 10
The General Data Protection Regulation (GDPR) formalizes the data subject’s right to data portability.
What is the objective of data portability?
- The controller has the right to move the data subject’s personal data from one organization to another.
- The data subject has the right to move personal data concerning him or her.
- The data subject has the right to move his/her personal data when moving to another country.
- The Supervisory Authority authorizes the movement of personal data.
Correct answer: B
