GDPR Data Management & Integration 3

Question 1

A healthcare organisation integrates patient records with a research database. Which GDPR provision most directly permits processing special-category data for scientific research?

Accepted Answer

Article 9(2)(j) — scientific research with appropriate safeguards

Answer

Article 9(2)(j) allows processing special-category data for scientific research purposes, provided appropriate safeguards such as pseudonymisation are applied.

Question 2

A company uses pseudonymisation when integrating datasets. According to GDPR, pseudonymised data is best described as:

Accepted Answer

Personal data that can no longer be attributed to a specific individual without additional information

Answer

Recital 26 and Article 4(5) define pseudonymised data as personal data that cannot be attributed to a specific data subject without additional information held separately.

Question 3

During a master data management (MDM) initiative, an organisation plans to create a 'golden record' consolidating personal data from five source systems. What GDPR principle requires that only necessary data fields be included in the golden record?

Accepted Answer

Data minimisation

Answer

Article 5(1)(c) data minimisation requires that personal data be adequate, relevant, and limited to what is necessary for the specified purpose.

Question 4

An API integration passes personal data between two controllers' systems in real time. Which security measure is most important to implement under Article 32 of the GDPR?

Accepted Answer

Encrypting data in transit using TLS

Answer

Article 32 requires appropriate technical measures including encryption; TLS encryption protects personal data in transit between systems.

Question 5

A joint data integration project involves two separate companies both determining the purposes and means of processing. Under GDPR, they are classified as:

Accepted Answer

Joint controllers under Article 26

Answer

Article 26 defines joint controllers as two or more entities that jointly determine the purposes and means of processing and requires a transparent arrangement between them.

(GDPR) Certified General Data Protection Regulation Specialist Practice Test

(GDPR) Certified General Data Protection Regulation Specialist Practice Test

GDPR Data Management & Integration 3