Verified & Latest GDPR Dump Q&As with Correct Answers [Q16-Q34]

Verified & Latest GDPR Dump Q&As with Correct Answers

Latest GDPR dumps - Instant Download PDF

NEW QUESTION # 16
Bus Spot is one of the largest bus operators in Spain. The company operates in local transport and bus rental since 2009. The success of Bus Spot can be attributed to the digitization of the bus ticketing system, through which clients can easily book tickets and stay up to date on any changes to their arrival or departure time. In recent years, due to the large number of passengers transported daily. Bus Spot has dealt with different incidents including vandalism, assaults on staff, and fraudulent injury claims. Considering the severity of these incidents, the need for having strong security measures had become crucial. Last month, the company decided to install a CCTV systemacross its network of buses. This security measure was taken to monitor the behavior of the company's employees and passengers, enabling crime prevention and ensuring safety and security. Following this decision, Bus Spot initiated a data protection impact assessment (DPIA). The outcome of each step of the DPIA was documented as follows: Step 1: In all 150 buses, two CCTV cameras will be installed. Only individuals authorized by Bus Spot will have access to the information generated by the CCTV system. CCTV cameras capture images only when the Bus Spot's buses are being used. The CCTV cameras will record images and sound. The information is transmitted to a video recorder and stored for 20 days. In case of incidents, CCTV recordings may be stored for more than 40 days and disclosed to a law enforcement body. Data collected through the CCTV system will be processed bv another organization. The purpose of processing this tvoe of information is to increase the security and safety of individuals and prevent criminal activity. Step 2: All employees of Bus Spot were informed for the installation of a CCTV system. As the data controller, Bus Spot will have the ultimate responsibility to conduct the DPIA. Appointing a DPO at that point was deemed unnecessary. However, the data processor's suggestions regarding the CCTV installation were taken into account. Step 3: Risk Likelihood (Unlikely, Possible, Likely) Severity (Moderate, Severe, Critical) Overall risk (Low, Medium, High) There is a risk that the principle of lawfulness, fairness, and transparency will be compromised since individuals might not be aware of the CCTV location and its field of view. Likely Moderate Low There is a risk that the principle of integrity and confidentiality may be compromised in case the CCTV system is not monitored and controlled with adequate security measures.
Possible Severe Medium There is a risk related to the right of individuals to be informed regarding the installation of CCTV cameras. Possible Moderate Low Step 4: Bus Spot will provide appropriate training to individuals that have access to the information generated by the CCTV system. In addition, it will ensure that the employees of the data processor are trained as well. In each entrance of the bus, a sign for the use of CCTV will be displayed. The sign will be visible and readable by all passengers. It will show other details such as the purpose of its use, the identity of Bus Spot, and its contact number in case there are any queries.
Only two employees of Bus Spot will be authorized to access the CCTV system. They will continuously monitor it and report any unusual behavior of bus drivers or passengers to Bus Spot. The requests of individuals that are subject to a criminal activity for accessing the CCTV images will be evaluated only for a limited period of time. If the access is allowed, the CCTV images will be exported by the CCTV system to an appropriate file format. Bus Spot will use a file encryption software to encrypt data before transferring onto another file format. Step 5: Bus Spot's top management has evaluated the DPIA results for the processing of data through CCTV system. The actions suggested to address the identified risks have been approved and will be implemented based on best practices. This DPIA involves the analysis of the risks and impacts in only a group of buses located in the capital of Spain. Therefore, the DPIA will be reconducted for each of Bus Spot's buses in Spain before installing the CCTV system. Based on this scenario, answer the following question:
Question:
According to scenario 6, whichdata protection solutionhas Bus Spot used to reduce the risk related to the principle of lawfulness, fairness, and transparency?

• A. Risk reduction
• B. Risk avoidance
• C. Risk transfer
• D. Risk retention

Answer: A

Explanation:
UnderArticle 5(1)(a) of GDPR, personal data must beprocessed lawfully, fairly, and transparently.Bus Spot implemented measures such as employee training and signage in buses, whichreduced risks associated with transparency.
* Option A is correctbecauseBus Spot took steps to reduce risk, such asclear notificationsigns and restricted CCTV access.
* Option B is incorrectbecauserisk retention means accepting the risk without mitigation, which Bus Spot did not do.
* Option C is incorrectbecauserisk transfer applies to outsourcing responsibilities (e.g., insurance), which is not the case here.
* Option D is incorrectbecauseBus Spot did not avoid risk entirely; they implemented controls to mitigate it.
References:
* GDPR Article 5(1)(a)(Principle of lawfulness, fairness, and transparency)
* Recital 39(Transparency in data processing)

NEW QUESTION # 17
Bus Spot is one of the largest bus operators in Spain. The company operates in local transport and bus rental since 2009. The success of Bus Spot can be attributed to the digitization of the bus ticketing system, through which clients can easily book tickets and stay up to date on any changes to their arrival or departure time. In recent years, due to the large number of passengers transported daily. Bus Spot has dealt with different incidents including vandalism, assaults on staff, and fraudulent injury claims. Considering the severity of these incidents, the need for having strong security measures had become crucial. Last month, the company decided to install a CCTV system across its network of buses. This security measure was taken to monitor the behavior of the company's employees and passengers, enabling crime prevention and ensuring safety and security. Following this decision, Bus Spot initiated a data protection impact assessment (DPIA). The outcome of each step of the DPIA was documented as follows: Step 1: In all 150 buses, two CCTV cameras will be installed. Only individuals authorized by Bus Spot will have access to the information generated by the CCTV system. CCTV cameras capture images only when the Bus Spot's buses are being used. The CCTV cameras will record images and sound. The information is transmitted to a video recorder and stored for 20 days. In case of incidents, CCTV recordings may be stored for more than 40 days and disclosed to a law enforcement body. Data collected through the CCTV system will be processed bv another organization. The purpose of processing this tvoe of information is to increase the security and safety of individuals and prevent criminal activity. Step2: All employees of Bus Spot were informed for the installation of a CCTV system. As the data controller, Bus Spot will have the ultimate responsibility to conduct the DPIA. Appointing a DPO at that point was deemed unnecessary. However, the data processor's suggestions regarding the CCTV installation were taken into account. Step 3: Risk Likelihood (Unlikely, Possible, Likely) Severity (Moderate, Severe, Critical) Overall risk (Low, Medium, High) There is a risk that the principle of lawfulness, fairness, and transparency will be compromised since individuals might not be aware of the CCTV location and its field of view. Likely Moderate Low There is a risk that the principle of integrity and confidentiality may be compromised in case the CCTV system is not monitored and controlled with adequate security measures.
Possible Severe Medium There is a risk related to the right of individuals to be informed regarding the installation of CCTV cameras. Possible Moderate Low Step 4: Bus Spot will provide appropriate training to individuals that have access to the information generated by the CCTV system. In addition, it will ensure that the employees of the data processor are trained as well. In each entrance of the bus, a sign for the use of CCTV will be displayed. The sign will be visible and readable by all passengers. It will show other details such as the purpose of its use, the identity of Bus Spot, and its contact number in case there are any queries.
Only two employees of Bus Spot will be authorized to access the CCTV system. They will continuously monitor it and report any unusual behavior of bus drivers or passengers to Bus Spot. The requests of individuals that are subject to a criminal activity for accessing the CCTV images will be evaluated only for a limited period of time. If the access is allowed, the CCTV images will be exported by the CCTV system to an appropriate file format. Bus Spot will use a file encryption software to encrypt data before transferring onto another file format. Step 5: Bus Spot's top management has evaluated the DPIA results for the processing of data through CCTV system. The actions suggested to address the identified risks have been approved and will be implemented based on best practices. This DPIA involves the analysis of the risks and impacts in only a group of buses located in the capital of Spain. Therefore, the DPIA will be reconducted for each of Bus Spot's buses in Spain before installing the CCTV system. Based on this scenario, answer the following question:
Question:
You are appointed as theDPO of Bus Spot.
What action would yousuggestwhen reviewing the results of theDPIApresented in scenario 6?

• A. Reconducting a DPIA for each busof Bus Spot isnot necessary, since the nature, scope, context, and purpose of data processing are similar in all buses.
• B. The DPIA should be reviewed annually, as CCTV surveillance presents ongoing risks to data subjects' privacy.
• C. Displaying the identity of Bus Spot, its contact number, and the purpose of data processingin each bus isnot necessary; furthermore, it breaches thedata protection principles defined by GDPR.
• D. Using a data processor for CCTV images is not in compliance with GDPR, since the data generated from the CCTV system should be controlled and processed by Bus Spot.

Answer: B

Explanation:
UnderArticle 35(11) of GDPR, controllersmust reassess DPIAs regularlyto account forchanging risksin processing activities likeCCTV surveillance.
* Option D is correctbecauseCCTV monitoring poses an ongoing risk, requiring periodic DPIA reviews.
* Option A is incorrectbecauseregular DPIA reviews are required, even if the data processing remains the same.
* Option B is incorrectbecausetransparency is a key principle of GDPR, and displaying information does not breach GDPR.
* Option C is incorrectbecausedata processors can process CCTV data as long as there is a processing agreement (Article 28).
References:
* GDPR Article 35(11)(Periodic DPIA review)
* Recital 90(Regular assessment of risks)

NEW QUESTION # 18
Scenario5:
Recpond is a German employment recruiting company. Their services are delivered globally and include consulting and staffing solutions. In the beginning. Recpond provided its services through an office in Germany. Today, they have grown to become one of the largest recruiting agencies, providing employment to more than 500,000 people around the world. Recpond receives most applications through its website. Job searchers are required to provide the job title and location. Then, a list of job opportunities is provided. When a job position is selected, candidates are required to provide their contact details and professional work experience records. During the process, they are informed that the information will be used only for the purposes and period determined by Recpond. Recpond's experts analyze candidates' profiles and applications and choose the candidates that are suitable for the job position. The list of the selected candidates is then delivered to Recpond's clients, who proceed with the recruitment process. Files of candidates that are not selected are stored in Recpond's databases, including the personal data of candidates who withdraw the consent on which the processing was based. When the GDPR came into force, the company was unprepared.
The top management appointed a DPO and consulted him for all data protection issues. The DPO, on the other hand, reported the progress of all data protection activities to the top management. Considering the level of sensitivity of the personal data processed by Recpond, the DPO did not have direct access to the personal data of all clients, unless the top management deemed it necessary. The DPO planned the GDPR implementation by initially analyzing the applicable GDPR requirements. Recpond, on the other hand, initiated a risk assessment to understand the risks associated with processing operations. The risk assessment was conducted based on common risks that employment recruiting companies face. After analyzing different risk scenarios, the level of risk was determined and evaluated. The results were presented to the DPO, who then decided to analyze only the risks that have a greater impact on the company. The DPO concluded that the cost required for treating most of the identified risks was higher than simply accepting them. Based on this analysis, the DPO decided to accept the actual level of the identified risks. After reviewing policies and procedures of the company. Recpond established a new data protection policy. As proposed by the DPO, the information security policy was also updated. These changes were then communicated to all employees of Recpond.Based on this scenario, answer the following question:
Question:
Based on scenario 5, Recpond established and communicated thedata protection policyto all employees.
What should theDPOensure in this regard?

• A. That all policies within Recpond arereviewed and updatedby the DPO.
• B. That theupdates of the data protection policyare communicated to all employees through anofficial letter.
• C. Thatemployee awarenesson the data protection policy is monitored.
• D. That thedata protection policy is approved by the supervisory authoritybefore implementation.

Answer: C

Explanation:
UnderArticle 39(1)(b) of GDPR, theDPO is responsible for raising awareness and training employeesbut does not draft or approve policies.
* Option B is correctbecauseDPOs must ensure employee awareness and training.
* Option A is incorrectbecauseDPOs do not have direct responsibility for updating policies.
* Option C is incorrectbecauseGDPR does not mandate policy updates via official letters.
* Option D is incorrectbecausesupervisory authorities do not approve internal data protection policies.
References:
* GDPR Article 39(1)(b)(DPO's role in employee training and awareness)
* Recital 97(DPO's responsibility for training)

NEW QUESTION # 19
Question:
UnderGDPR, the controller must demonstrate thatdata subjects have consentedto the processing of their personal data, and theconsent must be freely given.
What is therole of the DPO in ensuring compliancewith this requirement?

• A. TheDPO should ensurethat the controller hasimplemented procedures to provide evidencethat consent has been obtained for all relevant personal data.
• B. TheDPO should approvethe legal basis for consent processing before the controller can collect personal data.
• C. TheDPO should ensurethat the controller hasinformed data subjectsabout theirright to withdraw consent.
• D. TheDPO should personally recordinformation such aswho consented, when they consented, and how consent was given.

Answer: A

Explanation:
UnderArticle 7(1) of GDPR, controllers must be able todemonstrate that the data subject has given consent. TheDPO advises on ensuring these procedures are in placebutdoes not collect or approve consent directly.
* Option B is correctbecausethe DPO must verify that consent records exist and meet GDPR standards.
* Option A is incorrectbecauseinforming data subjects about withdrawal rights is the controller's duty, not the DPO's.
* Option C is incorrectbecausethe DPO does not personally maintain consent logs.
* Option D is incorrectbecauseDPOs do not approve legal bases for processing-this is the controller's responsibility.
References:
* GDPR Article 7(1)(Controller must demonstrate valid consent)
* GDPR Article 39(1)(b)(DPO ensures compliance with data protection obligations)

NEW QUESTION # 20
Scenario:
Pinky, a retail company,received a requestfrom adata subjectto identify which purchasesthey had madeat differentphysical store locations. However,Pinky does not link purchase records to customer identities, since purchasesdo not require account creation.
Question:
Should Pinkyprocess additional informationfrom customers in order toidentify the data subjectas requested?

• A. Yes, Pinky is required to process additional information for the purpose ofexercising the data subject' s rightscovered inArticles 15-21 of GDPR.
• B. No, but Pinky must ask the data subject to provide further evidence proving their identity.
• C. Yes, Pinky is required tomaintain, acquire, or process additional informationin order to identify the data subject.
• D. No, Pinky isnot requiredto process additional information, since the processing of personal data in this case does not require Pinky toidentify the data subject.

Answer: D

Explanation:
UnderArticle 11(1) of GDPR, controllersare not required to process additional datafor the sole purpose of identifying data subjectsif such identification is not needed for processing.
* Option C is correctbecausePinky does not store identifiable purchase data, so it is not required to create additional records.
* Option A and B are incorrectbecauseGDPR does not obligate controllers to process additional data if identification is unnecessary.
* Option D is incorrectbecausePinky cannot require additional information when it does not have a basis to process identity-linked data.
References:
* GDPR Article 11(1)(Controllers are not required to process extra data for identification)
* Recital 57(Data controllers should avoid collecting unnecessary identity data)

NEW QUESTION # 21
Scenario 8:MA store is an online clothing retailer founded in 2010. They provide quality products at a reasonable cost. One thing that differentiates MA store from other online shopping sites is their excellent customer service.
MA store follows a customer-centered business approach. They have created a user-friendly website with well-organized content that is accessible to everyone. Through innovative ideas and services, MA store offers a seamless user experience for visitors while also attracting new customers. When visiting the website, customers can filter their search results by price, size, customer reviews, and other features. One of MA store's strategies for providing, personalizing, and improving its products is data analytics. MA store tracks and analyzes the user actions on its website so it can create customized experience for visitors.
In order to understand their target audience, MA store analyzes shopping preferences of itscustomers based on their purchase history. The purchase history includes the product that was bought, shipping updates, and payment details. Clients' personal data and other information related to MA store products included in the purchase history are stored in separate databases. Personal information, such as clients' address or payment details, are encrypted using a public key. When analyzing the shopping preferences of customers, employees access only the information about the product while the identity of customers is removed from the data set and replaced with a common value, ensuring that customer identities are protected and cannot be retrieved.
Last year, MA store announced that they suffered a personal data breach where personal data of clients were leaked. The personal data breach was caused by an SQL injection attack which targeted MA store's web application. The SQL injection was successful since no parameterized queries were used.
Based on this scenario, answer the following question:
According to scenario 8, MA store analyzed shopping preferences of its customers by analyzing the product they have bought in the customer's purchase history. Which option is correct in this case?

• A. MA store can use this type of information only during the period for which data subjects have given consent
• B. MA store can use this type of information for an indefinite period of time since it is anonymized
• C. MA store can use this type of information for a limited period of time since it is pseudonymized

Answer: C

Explanation:
Since the data is pseudonymized (not fully anonymized), it remains personal data under GDPR and cannot be retained indefinitely. Article 5(1)(e) of GDPR states that personal data must be kept only for as long as necessary for the intended processing purpose. Additionally, Recital 26 of GDPR clarifies that pseudonymized data is still considered personal data if re-identification is possible. Therefore, MA Store must implement a retention policy that ensures the data is deleted or further anonymized once it is no longer needed for analysis.

NEW QUESTION # 22
Question:
You work in a company that providestraining services. One of the clientsrequests accessto information about thecategories of recipientsto whom theirpersonal data will be disclosed.
Whatactionsshould you take to becompliant with GDPR?

• A. Provide theclient with the requested informationabout the recipients of their data.
• B. Verify the identityof the client by sendinglogin datato their mailing address.
• C. Obtainauthorizationfrom the recipients before disclosing their identities.
• D. Inform the client thataccess to this type of information is not allowed, since it may result in ahigh risk to the rights and freedoms of recipients.

Answer: A

Explanation:
UnderArticle 15(1)(c) of GDPR, data subjects have theright to accessinformation about therecipients or categories of recipientswho have received their personal data.
* Option D is correctbecauseGDPR mandates transparency regarding data sharing.
* Option A is incorrectbecauseauthorization from recipients is not requiredbefore disclosing their categories.
* Option B is incorrectbecauseidentity verification applies to access requests but is not a prerequisite for providing recipient information.
* Option C is incorrectbecause denying access to this informationviolates the data subject's right under GDPR.
References:
* GDPR Article 15(1)(c)(Right of access to recipient categories)
* Recital 63(Transparency in processing and access rights)

NEW QUESTION # 23
Which of the statements below related to compliance monitoring is correct?

• A. The DPO should assign roles and responsibilities to monitor GDPR compliance
• B. The DPO should monitor internal compliance of the organization with applicable data protection laws
• C. The DPO should monitor and measure all activities of the organization in order to ensure the suitability and effectiveness of the GDPR compliance program

Answer: B

Explanation:
GDPR Article 39(1)(b) states that the DPO is responsible for monitoring internal compliance with data protection laws, rather than assigning responsibilities or measuring all activities.

NEW QUESTION # 24
Question:
Based onArticle 58 of GDPR, whatpowersmust thesupervisory authorityhave?

• A. Toobtain access to any premisesof the controller and processor, including data processing equipment.
• B. Toapprove all privacy policiesbefore they are implemented.
• C. Toappoint a single DPOin a group of undertakings.
• D. Toassign the tasks of the controller or the processorand monitor their implementation.

Answer: A

Explanation:
UnderArticle 58 of GDPR,supervisory authorities have investigative and corrective powers, includingthe ability to access premises and equipmentused for personal data processing.
* Option B is correctbecausesupervisory authorities can investigate controllers and processors, including accessing IT systems.
* Option A is incorrectbecausesupervisory authorities do not appoint DPOs; controllers and processors must do this themselves.
* Option C is incorrectbecausesupervisory authorities do not manage controllers' or processors' tasks.
* Option D is incorrectbecausesupervisory authorities do not pre-approve privacy policies.
References:
* GDPR Article 58(1)(f)(Supervisory authorities can access premises and data)
* Recital 129(Authorities must have investigation powers)

NEW QUESTION # 25
Scenario 8:MA store is an online clothing retailer founded in 2010. They provide quality products at a reasonable cost. One thing that differentiates MA store from other online shopping sites is their excellent customer service.
MA store follows a customer-centered business approach. They have created a user-friendly website with well-organized content that is accessible to everyone. Through innovative ideas and services, MA store offers a seamless user experience for visitors while also attracting new customers. When visiting the website, customers can filter their search results by price, size, customer reviews, and other features. One of MA store's strategies for providing, personalizing, and improving its products is data analytics. MA store tracks and analyzes the user actions on its website so it can create customized experience for visitors.
In order to understand their target audience, MA store analyzes shopping preferences of its customers based on their purchase history. The purchase history includes the product that was bought, shipping updates, and payment details. Clients' personal data and other information related to MA store products included in the purchase history are stored in separate databases. Personal information, such as clients' address or payment details, are encrypted using a public key. When analyzing the shopping preferences of customers, employees access only the information about the product while the identity of customers is removed from the data set and replaced with a common value, ensuring that customer identities are protected and cannot be retrieved.
Last year, MA store announced that they suffered a personal data breach where personal data of clients were leaked. The personal data breach was caused by an SQL injection attack which targeted MA store's web application. The SQL injection was successful since no parameterized queries were used.
Based on this scenario, answer the following question:
Which de-identification method has MA store used when analyzing the shopping preferences of its customers?

• A. Differential privacy
• B. Scrambling
• C. Generalizing data with k-anonymity

Answer: C

Explanation:
MA Store replaces customer identities with a common value when analyzing shopping preferences, ensuring that the data subject's identity cannot be retrieved. This method aligns withk-anonymity, where personal identifiers are removed or generalized to protect individuals from re-identification. The goal of k-anonymity is to prevent unique identification by ensuring that each data entry is indistinguishable from at least k-1 other entries. This is an effective way to process data while maintaining compliance with GDPR principles of data minimization (Article 5(1)(c)) and anonymization.

NEW QUESTION # 26
Scenario4:
Berc is a pharmaceutical company headquartered in Paris, France, known for developing inexpensive improved healthcare products. They want to expand to developing life-saving treatments. Berc has been engaged in many medical researches and clinical trials over the years. These projects required the processing of large amounts of data, including personal information. Since 2019, Berc has pursued GDPR compliance to regulate data processing activities and ensure data protection. Berc aims to positively impact human health through the use of technology and the power of collaboration. They recently have created an innovative solution in participation with Unty, a pharmaceutical company located in Switzerland. They want to enable patients to identify signs of strokes or other health-related issues themselves. They wanted to create a medical wrist device that continuously monitors patients' heart rate and notifies them about irregular heartbeats. The first step of the project was to collect information from individuals aged between 50 and 65. The purpose and means of processing were determined by both companies. The information collected included age, sex, ethnicity, medical history, and current medical status. Other information included names, dates of birth, and contact details. However, the individuals, who were mostly Berc's and Unty's customers, were not aware that there was an arrangement between Berc and Unty and that both companies have access to their personal data and share it between them. Berc outsourced the marketing of their new product to an international marketing company located in a country that had not adopted the adequacy decision from the EU commission. However, since they offered a good marketing campaign, following the DPO's advice, Berc contracted it. The marketing campaign included advertisement through telephone, emails, and social media. Berc requested that Berc's and Unty's clients be first informed about the product. They shared the contact details of clients with the marketing company.Based on this scenario, answer the following question:
Question:
Is the transfer of data fromBerc to Untyin compliance with GDPR?

• A. Yes, Berc can transfer data to Unty because they collected data for the same purpose.
• B. No, Berc must conduct a new DPIA before transferring data to Switzerland.
• C. No, Berc cannot transfer data to a company in Switzerland unless authorization from the supervisory authority in France is obtained.
• D. Yes, Berc can transfer data to Unty because Switzerland provides a level of data protection that is
  "essentially equivalent" to that of the EU.

Answer: D

Explanation:
UnderArticle 45 of GDPR,data transfers to third countriesare lawful if the European Commission has adopted an adequacy decision, meaning the countryoffers equivalent protection to GDPR. Switzerland has such an adequacy decision, makingBerc's transfer lawful.
* Option A is correctbecause Switzerlandmeets GDPR adequacy standards.
* Option B is incorrectbecausehaving the same purpose does not automatically make the transfer lawful.
* Option C is incorrectbecauseno supervisory authorization is neededwhen an adequacy decision exists.
* Option D is incorrectbecausea DPIA is not required for a GDPR-compliant transfer.
References:
* GDPR Article 45(1)(Adequacy decisions for third countries)
* European Commission Decision on Switzerland's adequacy

NEW QUESTION # 27
Scenario 9:Soin is a French travel agency with the largest network of professional travel agents throughout Europe. They aim to create unique vacations for clients regardless of the destinations they seek. The company specializes in helping people find plane tickets, reservations at hotels, cruises, and other activities.
As any other industry, travel is no exception when it comes to GDPR compliance. Soin was directly affected by the enforcement of GDPR since its main activities require the collection and processing of customers' data.
Data collected by Soin includes customer's ID or passport details, financial and payment information, and contact information. This type of data is defined as personal by the GDPR; hence, Soin's data processing activities are built based on customer's consent.
At the beginning, as for many other companies, GDPR compliance was a complicated issue for Soin.
However, the process was completed within a few months and later on the company appointed a DPO. Last year, the supervisory authority of France, requested the conduct of a data protection external audit in Soin without an early notice. To ensure GDPR compliance before an external audit was conducted, Soin organized an internal audit. The data protection internal audit was conducted by the DPO of the company. The audit was initiated by firstly confirming the accuracy of records related to all current Soin's data processing activities.
The DPO considered that verifying compliance to Article 30 of GDPR would help in defining the data protection internal audit scope. The DPO noticed that not all processing activities of Soin were documented as required by the GDPR. For example, processing activities records of the company did not include a description of transfers of personal data to third countries. In addition, there was no clear description of categories of personal data processed by the company. Other areas that were audited included content of data protection policy, data retention guidelines, how sensitive data is stored, and security policies and practices.
The DPO conducted interviews with some employees at different levels of the company. During the audit, the DPO came across some emails sent by Soin's clients claiming that they do not have access in their personal data stored by Soin. Soin's Customer Service Department answered the emails saying that, based on Soin's policies, a client cannot have access to personal data stored by the company. Based on the information gathered, the DPO concluded that there was a lack of employee awareness on the GDPR.
All these findings were documented in the audit report. Once the audit was completed, the DPO drafted action plans to resolve the nonconformities found. Firstly, the DPO created a new procedure which could ensure the right of access to clients. All employees were provided with GDPR compliance awareness sessions.
Moreover, the DPO established a document which described the transfer of personal data to third countries and the applicability of safeguards when this transfer is done to an international organization.
Based on this scenario, answer the following question:
Based on scenario 9, the supervisory authority requested the conduct of a data protection audit in Soin without early notice. Is this acceptable?

• A. Yes, the supervisory authority may perform external audits randomly or after notification of the occurrence of a data breach in the company
• B. No, the supervisory authority may perform only scheduled external audits with at least two weeks' notice after the occurrence of a data breach in the company
• C. No, the supervisory authority can conduct a data protection external audit only if it is requested by the controller

Answer: A

Explanation:
Under GDPR Article 58(1)(b) and (d), supervisory authorities have the power to carry out data protection audits at their discretion. They do not need prior approval from the controller and may act proactively to ensure compliance. Supervisory authorities can investigate companies evenwithout a data breach, especially if there are concerns about GDPR compliance.

NEW QUESTION # 28
Scenario1:
MED is a healthcare provider located in Norway. It provides high-quality and affordable healthcare services, including disease prevention, diagnosis, and treatment. Founded in 1995, MED is one of the largest health organizations in the private sector. The company has constantly evolved in response to patients' needs.
Patients that schedule an appointment in MED's medical centers initially need to provide their personal information, including name, surname, address, phone number, and date of birth. Further checkups or admission require additional information, including previous medical history and genetic data. When providing their personal data, patients are informed that the data is used for personalizing treatments and improving communication with MED's doctors. Medical data of patients, including children, are stored in the database of MED's health information system. MED allows patients who are at least 16 years old to use the system and provide their personal information independently. For children below the age of 16, MED requires consent from the holderof parental responsibility before processing their data.
MED uses a cloud-based application that allows patients and doctors to upload and access information.
Patients can save all personal medical data, including test results, doctor visits, diagnosis history, and medicine prescriptions, as well as review and track them at any time. Doctors, on the other hand, can access their patients' data through the application and can add information as needed.
Patients who decide to continue their treatment at another health institution can request MED to transfer their data. However, even if patients decide to continue their treatment elsewhere, their personal data is still used by MED. Patients' requests to stop data processing are rejected. This decision was made by MED's top management to retain the information of everyone registered in their databases.
The company also shares medical data with InsHealth, a health insurance company. MED's data helps InsHealth create health insurance plans that meet the needs of individuals and families.
MED believes that it is its responsibility to ensure the security and accuracy of patients' personal data. Based on the identified risks associated with data processing activities, MED has implemented appropriate security measures to ensure that data is securely stored and processed.
Since personal data of patients is stored and transmitted over the internet, MED uses encryption to avoid unauthorized processing, accidental loss, or destruction of data. The company has established a security policy to define the levels of protection required for each type of information and processing activity. MED has communicated the policy and other procedures to personnel and provided customized training to ensure proper handling of data processing.
Question:
Based on scenario 1, MED shares patients' personal data with a health insurance company. Does MED comply with thepurpose limitation principle?

• A. Yes, as long as the data is encrypted before sharing.
• B. No, personal data should be collected for specified, explicit, and legitimate purposes in accordance with Article 5 of GDPR.
• C. Yes, using personal data for creating health insurance plans is within the scope of the data collection purpose.
• D. Yes, personal data may be used for purposes in the public interest or statistical purposes in accordance withArticle 89 of GDPR.

Answer: B

NEW QUESTION # 29
Scenario:
Aclinical research organizationcollects and processessensitive personal dataof individuals formedical research purposes. The data isencrypted and stored in a central database using a one-way hashing function (bcrypt). The organization conducted arisk assessmentto identify andmitigate risks.
Question:
Should aDPIA be conductedin this case?

• A. Yes, a DPIA should be conducted whensensitive personal data of vulnerable personsis collected, based on theidentified risk from the risk assessment.
• B. No, because the personal datais encrypted.
• C. Yes, but only if the data isretained for more than five years.
• D. No, because the organizationhas already conducted a risk assessment.

Answer: A

Explanation:
UnderArticle 35(3)(b) of GDPR, aDPIA is required for large-scale processing of sensitive data, including medical research on vulnerable individuals.
* Option A is correctbecausemedical data and research involving vulnerable individuals require a DPIA.
* Option B is incorrectbecauseencryption does not eliminate the need for a DPIA if the processing poses high risks.
* Option C is incorrectbecausea general risk assessment does not replace a DPIAunderArticle 35.
* Option D is incorrectbecauseretention period is not a deciding factor for DPIA necessity.
References:
* GDPR Article 35(3)(b)(DPIA for special category data)
* Recital 91(Risks to fundamental rights require DPIAs)

NEW QUESTION # 30
Scenario4:
Berc is a pharmaceutical company headquartered in Paris, France, known for developing inexpensive improved healthcare products. They want to expand to developing life-saving treatments. Berc has been engaged in many medical researches and clinical trials over the years. These projects required the processing of large amounts of data, including personal information. Since 2019, Berc has pursued GDPR compliance to regulate data processing activities and ensure data protection. Berc aims to positively impact human health through the use of technology and the power of collaboration. They recently have created an innovative solution in participation with Unty, a pharmaceutical company located in Switzerland. They want to enable patients to identify signs of strokes or other health-related issues themselves. They wanted to create a medical wrist device that continuously monitors patients' heart rate and notifies them about irregular heartbeats. The first step of the project was to collect information from individuals aged between 50 and 65. The purpose and means of processing were determined by both companies. The information collected included age, sex, ethnicity, medical history, and current medical status. Other information included names, dates of birth, and contact details. However, the individuals, who were mostly Berc's and Unty's customers, were not aware that there was an arrangement between Berc and Unty and that both companies have access to their personal data and share it between them. Berc outsourced the marketing of their new product to an international marketing company located in a country that had not adopted the adequacy decision from the EU commission. However, since they offered a good marketing campaign, following the DPO's advice, Berc contracted it. The marketing campaign included advertisement through telephone, emails, and social media. Berc requested that Berc's and Unty's clients be first informed about the product. They shared the contact details of clients with the marketing company.Based on this scenario, answer the following question:
Question:
Based on scenario 4,Berc followed the DPO's advice for outsourcing an international marketing companyin the absence of an adequacy decision. Is the DPO responsible for evaluating this case?

• A. Yes, the DPO should evaluate cases where an adequacy decision is absent.
• B. No, the controller or processor should evaluate cases when the adequacy decision is absent.
• C. No, because the marketing company operates under the same data protection rules as Berc.
• D. Yes, the DPO takes the final decision on transferring personal data to an international company in the absence of an adequacy decision.

Answer: B

Explanation:
UnderArticle 44 of GDPR, thecontroller (Berc)is responsible forensuring lawful data transfers. TheDPO advises on compliancebut doesnot make final decisionson data transfers.
* Option C is correctbecause thecontroller (Berc) must evaluate the legality of the transfer.
* Option A is incorrectbecauseDPOs provide advice but do not evaluate data transfer legality.
* Option B is incorrectbecauseDPOs do not have executive decision-making authority.
* Option D is incorrectbecausedata protection rules vary by jurisdiction, making this assumption incorrect.
References:
* GDPR Article 44(General principle for transfers)
* GDPR Article 39(1)(a)(DPO's advisory role)

NEW QUESTION # 31
Scenario3:
COR Bank is an international banking group that operates in 31 countries. It was formed as themerger of two well-known investment banks in Germany. Their two main fields of business are retail and investment banking. COR Bank provides innovative solutions for services such as payments, cash management, savings, protection insurance, and real-estate services. COR Bank has a large number of clients and transactions.
Therefore, they process large information, including clients' personal data. Some of the data from the application processes of COR Bank, including archived data, is operated by Tibko, an IT services company located in Canada. To ensure compliance with the GDPR, COR Bank and Tibko have reached a data processing agreement Based on the agreement, the purpose and conditions of data processing are determined by COR Bank. However, Tibko is allowed to make technical decisions for storing the data based on its own expertise. COR Bank aims to remain a trustworthy bank and a long-term partner for its clients. Therefore, they devote special attention to legal compliance. They started the implementation process of a GDPR compliance program in 2018. The first step was to analyze the existing resources and procedures. Lisa was appointed as the data protection officer (DPO). Being the information security manager of COR Bank for many years, Lisa had knowledge of the organization's core activities. She was previously involved in most of the processes related to information systems management and data protection. Lisa played a key role in achieving compliance to the GDPR by advising the company regarding data protection obligations and creating a data protection strategy. After obtaining evidence of the existing data protection policy, Lisa proposed to adapt the policy to specific requirements of GDPR. Then, Lisa implemented the updates of the policy within COR Bank. To ensure consistency between processes of different departments within the organization, Lisa has constantly communicated with all heads of GDPR. Then, Lisa implemented the updates of the policy within COR Bank. To ensure consistency between processes of different departments within the organization, Lisa has constantly communicated with all heads of departments. As the DPO, she had access to several departments, including HR and Accounting Department. This assured the organization that there was a continuous cooperation between them. The activities of some departments within COR Bank are closely related to data protection. Therefore, considering their expertise, Lisa was advised from the top management to take orders from the heads of those departments when taking decisions related to their field. Based on this scenario, answer the following question:
Question:
Based on scenario 3,Lisa was advised to take orders from the heads of other departments. Is this acceptable under GDPR?

• A. Yes, the DPO is responsible for following management directives while ensuring GDPR compliance.
• B. Yes, only heads of departments within a financial institution are allowed to give orders to the DPO.
• C. Yes, the DPO shall take instructions and tasks from employee members if required by the organization.
• D. No, the organization should not influence, nor put pressure on the DPO for any decision taken.

Answer: D

Explanation:
UnderArticle 38(3) of GDPR,the DPO must operate independently, without receivinginstructions regarding the execution of their tasks. A DPO should not bepressured or influencedby the organization when assessing data protection compliance.
* Option C is correctbecause GDPR explicitly states that DPOsmust act independently.
* Option A is incorrectbecauseno department headsshould interfere with the DPO's decisions.
* Option B is incorrectbecauseDPOs should not take orders on GDPR matters.
* Option D is incorrectbecause DPOsmust not be influenced by management, even if they provide general compliance guidance.
References:
* GDPR Article 38(3)(DPO independence)
* Recital 97(DPO's autonomy and protection from pressure)

NEW QUESTION # 32
Scenario4:
Berc is a pharmaceutical company headquartered in Paris, France, known for developing inexpensive improved healthcare products. They want to expand to developing life-saving treatments. Berc has been engaged in many medical researches and clinical trials over the years. These projects required the processing of large amounts of data, including personal information. Since 2019, Berc has pursued GDPR compliance to regulate data processing activities and ensure data protection. Berc aims to positively impact human health through the use of technology and the power of collaboration. They recently have created an innovative solution in participation with Unty, a pharmaceutical company located in Switzerland. They want to enable patients to identify signs of strokes or other health-related issues themselves. They wanted to create a medical wrist device that continuously monitors patients' heart rate and notifies them about irregular heartbeats. The first step of the project was to collect information from individuals aged between 50 and 65. The purpose and means of processing were determined by both companies. The information collected included age, sex, ethnicity, medical history, and current medical status. Other information included names, dates of birth, and contact details. However, the individuals, who were mostly Berc's and Unty's customers, were not aware that there was an arrangement between Berc and Unty and that both companies have access to their personal data and share it between them. Berc outsourced the marketing of their new product to an international marketing company located in a country that had not adopted the adequacy decision from the EU commission. However, since they offered a good marketing campaign, following the DPO's advice, Berc contracted it. The marketing campaign included advertisement through telephone, emails, and social media. Berc requested that Berc's and Unty's clients be first informed about the product. They shared the contact details of clients with the marketing company.Based on this scenario, answer the following question:
Question:
Based on scenario 4, Bercshared personal information of its clients with an international marketing companyeven thoughan adequacy decision was absent. Which of the following is avalid reasonto do so?

• A. The marketing company's reputation ensures compliance with data protection standards.
• B. The transfer of data does not depend on the adoption of an adequacy decision by the country where the company is located.
• C. Thecontroller or processor provides appropriate safeguardsfor data protection.
• D. Authorization for data transfer from Berc'sChief Information Security Officer (CISO)is obtained.

Answer: C

Explanation:
UnderArticle 46 of GDPR, in theabsence of an adequacy decision, controllers can transfer dataonly if appropriate safeguards(e.g., Standard Contractual Clauses, Binding Corporate Rules) are in place.
* Option C is correctbecausesafeguards such as SCCsallow data transfers when no adequacy decision exists.
* Option A is incorrectbecauseadequacy decisions are a legal requirement, not optional.
* Option B is incorrectbecausea CISO cannot authorize GDPR data transfers.
* Option D is incorrectbecausereputation does not ensure GDPR compliance.
References:
* GDPR Article 46(1)(Appropriate safeguards for data transfers)
* Recital 108(Legally binding commitments for data protection)

NEW QUESTION # 33
Scenario 9:Soin is a French travel agency with the largest network of professional travel agentsthroughout Europe. They aim to create unique vacations for clients regardless of the destinations they seek. The company specializes in helping people find plane tickets, reservations at hotels, cruises, and other activities.
As any other industry, travel is no exception when it comes to GDPR compliance. Soin was directly affected by the enforcement of GDPR since its main activities require the collection and processing of customers' data.
Data collected by Soin includes customer's ID or passport details, financial and payment information, and contact information. This type of data is defined as personal by the GDPR; hence, Soin's data processing activities are built based on customer's consent.
At the beginning, as for many other companies, GDPR compliance was a complicated issue for Soin.
However, the process was completed within a few months and later on the company appointed a DPO. Last year, the supervisory authority of France, requested the conduct of a data protection external audit in Soin without an early notice. To ensure GDPR compliance before an external audit was conducted, Soin organized an internal audit. The data protection internal audit was conducted by the DPO of the company. The audit was initiated by firstly confirming the accuracy of records related to all current Soin's data processing activities.
The DPO considered that verifying compliance to Article 30 of GDPR would help in defining the data protection internal audit scope. The DPO noticed that not all processing activities of Soin were documented as required by the GDPR. For example, processing activities records of the company did not include a description of transfers of personal data to third countries. In addition, there was no clear description of categories of personal data processed by the company. Other areas that were audited included content of data protection policy, data retention guidelines, how sensitive data is stored, and security policies and practices.
The DPO conducted interviews with some employees at different levels of the company. During the audit, the DPO came across some emails sent by Soin's clients claiming that they do not have access in their personal data stored by Soin. Soin's Customer Service Department answered the emails saying that, based on Soin's policies, a client cannot have access to personal data stored by the company. Based on the information gathered, the DPO concluded that there was a lack of employee awareness on the GDPR.
All these findings were documented in the audit report. Once the audit was completed, the DPO drafted action plans to resolve the nonconformities found. Firstly, the DPO created a new procedure which could ensure the right of access to clients. All employees were provided with GDPR compliance awareness sessions.
Moreover, the DPO established a document which described the transfer of personal data to third countries and the applicability of safeguards when this transfer is done to an international organization.
Based on this scenario, answer the following question:
Soin's DPO conducted an internal data protection audit. Is this acceptable?

• A. No, only the supervisory authority is responsible for conducting investigations in the form of internal data protection audits
• B. Yes, the DPO can conduct an internal data protection audit as part of monitoring compliance
• C. No, the role of the DPO is to only assist the company in conducting an internal data protection audit

Answer: B

Explanation:
Under GDPR Article 39(1)(b), the DPO is responsible for monitoring compliance with GDPR, including conducting internal audits. The DPO's role includes overseeing data protection policies, raising awareness, and ensuring adherence to regulations. The internal audit conducted by the DPO at Soin aligns with these responsibilities. However, while the DPO can conduct internal audits, the supervisory authority is responsible for external investigations and enforcement actions under GDPR Article 58.

NEW QUESTION # 34
......

The Ultimate PECB GDPR Dumps PDF Review: https://www.actualcollection.com/GDPR-exam-questions.html

Updated Verified GDPR Downloadable Printable Exam Dumps: https://drive.google.com/open?id=19gg1C-RU0-IGip8B_imMc0iyUDb4Sqls