CDPSE Subject Rights 5

Question 1

Under GDPR, what is the standard timeframe for a controller to respond to a data subject access request?

Accepted Answer

One month

Answer

GDPR Article 12 requires controllers to respond to data subject requests without undue delay and at most within one month of receiving the request.

Question 2

Which of the following is an example of 'pseudonymization' that still retains subject rights applicability?

Accepted Answer

Replacing names with codes where the mapping key is retained separately

Answer

Pseudonymization replaces identifying information with a code, but because the key exists to re-identify, the data remains personal data and subject rights still apply.

Question 3

An employee asks their employer to delete all personal data collected about them. Under GDPR, which exemption most likely allows the employer to retain employment records?

Accepted Answer

Legal obligation to maintain employment and payroll records under national law

Answer

Employment records are typically subject to statutory retention requirements, qualifying as a legal obligation that overrides the erasure right under GDPR Article 17(3)(b).

Question 4

The Colorado Privacy Act (CPA) grants consumers a right to appeal. What does this right entail?

Accepted Answer

The right to appeal a controller's refusal to act on a rights request within a specified period

Answer

The Colorado Privacy Act requires controllers to establish an appeals process allowing consumers to challenge a controller's refusal to honor a privacy rights request.

Question 5

A data subject requests their personal data be ported to a new service provider. The controller argues the data is too voluminous to transfer. Is this a valid reason to refuse portability under GDPR?

Accepted Answer

No, volume alone is not a valid exemption; the controller must provide the data

Answer

GDPR does not recognize data volume as an exemption for portability; controllers must provide the data unless a specific legal exception applies.

CDPSE - Certified Data Privacy Solutions Engineer Practice Test

CDPSE - Certified Data Privacy Solutions Engineer Practice Test

CDPSE Subject Rights 5