GDPR GDPR International Data Transfers

Question 1

Which GDPR mechanism allows personal data to be transferred to a third country that the European Commission has deemed to provide adequate protection?

Accepted Answer

Adequacy Decision

Answer

Standard Contractual Clauses

Answer

Binding Corporate Rules

Answer

Derogations under Article 49

Question 2

What are Standard Contractual Clauses (SCCs) under GDPR?

Accepted Answer

Pre-approved contractual templates adopted by the European Commission to safeguard cross-border data flows

Answer

Internal company policies for data transfers

Answer

Agreements between EU member states for sharing government data

Answer

Clauses required in all employment contracts involving personal data

Question 3

Under GDPR Article 47, Binding Corporate Rules (BCRs) must be approved by:

Accepted Answer

The relevant national supervisory authority and recognized by other EEA authorities

Answer

The European Data Protection Board alone

Answer

The organization's DPO and CEO

Answer

Only the data subjects whose data is being transferred

Question 4

Following the Schrems II ruling (C-311/18), what happened to the EU-US Privacy Shield?

Accepted Answer

It was invalidated by the Court of Justice of the EU

Answer

It was upheld and remains valid

Answer

It was replaced by BCRs

Answer

It was transferred to the EDPB for management

Question 5

What supplementary measure might organizations adopt when SCCs alone are insufficient after a Schrems II transfer impact assessment?

Accepted Answer

Applying end-to-end encryption so that data is unintelligible to the importing country's authorities

Answer

Requesting a new adequacy decision for every transfer

Answer

Requiring data subjects to waive their GDPR rights

Answer

Filing a complaint with the EDPB

Question 6

Under GDPR Article 49, which derogation permits a one-off international data transfer in the absence of adequacy or safeguards?

Accepted Answer

The transfer is necessary for the performance of a contract between the data subject and the controller

Answer

The transfer serves the controller's legitimate interests exclusively

Answer

The transfer involves only anonymized data

Answer

The transfer is for academic research purposes only