GDPR Specialist Obligations of Data Controllers and Processors

Question 1

What is a primary responsibility of a data controller under GDPR?

Accepted Answer

Determining purposes and means of data processing

Answer

The data controller is the central figure in GDPR compliance, primarily responsible for deciding why and how personal data is processed. This includes ensuring all processing activities adhere to GDPR principles and that data subjects' rights are upheld throughout the data lifecycle.

Question 2

What must data controllers and processors implement under GDPR?

Accepted Answer

Technical and organizational security measures

Answer

Both data controllers and processors are required to implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk of processing personal data. This includes measures like encryption, pseudonymization, and regular security assessments to protect data integrity and confidentiality.

Question 3

Which document must processors maintain under GDPR?

Accepted Answer

Record of processing activities

Answer

Under GDPR, data processors are required to maintain a record of all categories of processing activities carried out on behalf of a controller. This record serves as a crucial accountability tool, detailing information such as the name and contact details of the processor, categories of processing, and security measures implemented.

Question 4

When must a data breach be reported to the supervisory authority?

Accepted Answer

Within 72 hours

Answer

In the event of a personal data breach, the data controller must notify the relevant supervisory authority without undue delay and, where feasible, not later than 72 hours after becoming aware of it. This notification is required unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons.

Question 5

What is required before a processor can engage another processor?

Accepted Answer

Written authorization from the controller

Answer

Under GDPR, a data processor cannot engage another processor (a sub-processor) without prior specific or general written authorization from the data controller. This ensures the controller maintains oversight and accountability for all entities involved in processing personal data, extending their responsibility down the processing chain.

(GDPR) Certified General Data Protection Regulation Specialist Practice Test

(GDPR) Certified General Data Protection Regulation Specialist Practice Test

GDPR Specialist Obligations of Data Controllers and Processors