Practice Test GeeksCDPSE - Certified Data Privacy Solutions Engineer Practice Test
← All CDPSE Flashcard Decks

Subject Rights Flashcards

7 cards from real CDPSE practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.

Read the first 7 Subject Rights flashcards as text

  1. A data subject objects to their personal data being used for direct marketing. Under GDPR, what must the controller do?

    Answer: Cease processing for direct marketing immediately and without exception

    GDPR Article 21(3) states that when a data subject objects to direct marketing, the controller must stop processing for that purpose immediately with no balancing test.

  2. Under GDPR, what must accompany a decision made solely by automated processing that significantly affects a data subject?

    Answer: The right to obtain human review, express their point of view, and contest the decision

    GDPR Article 22 requires that data subjects have the right to human intervention, to express their view, and to contest automated decisions that significantly affect them.

  3. Which of the following is NOT a lawful basis for refusing a data subject access request under GDPR?

    Answer: The data was collected from a third party

    The origin of data from a third party is not a valid ground for refusing an access request; organizations must provide data regardless of its source.

  4. A data subject requests rectification of inaccurate data. What obligation does the controller have regarding third parties who received the incorrect data?

    Answer: Inform each recipient of the rectification unless it is impossible or involves disproportionate effort

    GDPR Article 19 requires controllers to notify all recipients of the corrected data unless doing so is impossible or involves disproportionate effort.

  5. Under the Virginia Consumer Data Protection Act (VCDPA), which right allows consumers to correct inaccuracies in their personal data?

    Answer: Right to correct

    The VCDPA grants consumers a right to correct inaccuracies in the personal data held by a controller.

  6. What is the maximum fee a GDPR controller can charge for handling a data subject access request?

    Answer: No fee may be charged for the first request

    Under GDPR, the first copy of data requested must be provided free of charge; fees may only be charged for additional copies or manifestly unfounded/excessive requests.

  7. Which of the following scenarios qualifies as profiling under GDPR?

    Answer: Using algorithms to analyze personal data to predict behavior or preferences

    GDPR defines profiling as any automated processing of personal data to evaluate, analyze, or predict aspects of a natural person's behavior or characteristics.