CSC GDPR Data Protection Principles 2

Question 1

Under GDPR's storage limitation principle, personal data must be kept in a form that permits identification of data subjects for no longer than:

Accepted Answer

No longer than is necessary for the purposes for which it is processed

Answer

The duration the controller deems necessary

Answer

As long as the data subject consents to storage

Answer

A maximum of five years under all circumstances

Question 2

A healthcare provider collects patient data for treatment but later wants to use it for marketing. Under GDPR's purpose limitation principle, this secondary use is:

Accepted Answer

Permitted only with a new explicit consent from patients

Answer

Permitted if the data was already collected

Answer

Automatically compatible because healthcare is a legitimate interest

Answer

Permitted without restriction since the data is already held

Question 3

Which GDPR principle requires that personal data must be accurate and, where necessary, kept up to date?

Accepted Answer

Accuracy

Answer

Storage limitation

Answer

Data minimisation

Answer

Integrity and confidentiality

Question 4

An e-commerce site collects a customer's full medical history during checkout 'just in case it's useful later.' Which GDPR principle is most directly violated?

Accepted Answer

Data minimisation

Answer

Lawfulness

Answer

Storage limitation

Answer

Accountability

Question 5

The GDPR principle of 'integrity and confidentiality' most directly requires controllers to:

Accepted Answer

Ensure data is processed using appropriate technical and organisational security measures

Answer

Publish their data processing activities publicly

Answer

Limit data retention to 90 days by default

Answer

Obtain a data protection officer for all processing

Question 6

Under the accountability principle, which of the following best demonstrates compliance?

Accepted Answer

Maintaining documented records of processing activities and impact assessments

Answer

Verbally assuring regulators that data is handled correctly

Answer

Delegating all compliance decisions to processors

Answer

Publishing annual revenue figures

Question 7

A company pseudonymises customer data before using it for analytics. Under GDPR, pseudonymised data is:

Accepted Answer

Still personal data if re-identification is possible

Answer

No longer personal data and fully exempt from GDPR

Answer

Treated identically to fully anonymised data

Answer

Exempt from all data minimisation requirements