GDPR GDPR Lawful Bases for Processing 3

Question 1

Under GDPR, which lawful basis is often described as the 'gold standard' but is frequently misapplied by organizations?

Accepted Answer

Consent

Answer

Legal obligation

Answer

Legitimate interests

Answer

Public task

Question 2

Under GDPR, data subjects have the right to object to processing based on which lawful bases?

Accepted Answer

Legitimate interests and public task

Answer

Contract and consent

Answer

Legal obligation and vital interests

Answer

All six lawful bases equally

Question 3

Which of the following statements about consent as a lawful basis is correct under GDPR?

Accepted Answer

Withdrawal of consent must be as easy as giving it

Answer

Silence or pre-ticked boxes constitute valid consent

Answer

Consent can be bundled with general terms and conditions

Answer

Consent, once given, cannot be withdrawn

Question 4

Under GDPR, what additional rule applies when processing personal data of children using consent as the lawful basis for information society services?

Accepted Answer

Parental or guardian consent is required for children below the applicable age threshold (16 by default, minimum 13)

Answer

No special rules apply to children's consent under GDPR

Answer

Children under 18 can never provide valid consent under any circumstances

Answer

Children's data may only be processed under the legal obligation basis

Question 5

The balancing test within a Legitimate Interests Assessment (LIA) requires the controller to weigh:

Accepted Answer

The controller's legitimate interest against the data subject's rights, interests, and freedoms

Answer

The financial cost of processing against its operational benefits

Answer

The number of data subjects affected against the type of data processed

Answer

The duration of retention against the sensitivity of the personal data

Question 6

Which GDPR provision requires that the lawful basis for processing be identified and documented before processing begins?

Accepted Answer

Article 13/14 combined with Article 6, supported by Recital 40, requiring a prior lawful basis

Answer

Article 5 (data minimisation principle)

Answer

Article 32 (security of processing)

Answer

Article 28 (processor contracts)

Question 7

If a data subject withdraws consent that was the sole lawful basis for processing, what must the controller do?

Accepted Answer

Cease processing for the purpose the consent covered, unless another lawful basis applies

Answer

Continue processing until the end of the pre-defined retention period

Answer

Transfer the data to another controller who holds a different lawful basis

Answer

Notify the supervisory authority immediately upon withdrawal