GDPR Implementation & Configuration 2 — Questions and Answers
Question 1: When configuring a cookie consent banner under GDPR, which technical requirement ensures consent is freely given?
- Pre-ticking optional cookie checkboxes by default
- Making the 'Accept All' button visually identical in size to 'Reject All' (Correct answer)
- Bundling consent for analytics cookies with consent for functional cookies
- Refusing site access until the user accepts all cookies
Correct answer: Making the 'Accept All' button visually identical in size to 'Reject All'
Consent is only freely given when accepting and rejecting are presented with equal prominence, so neither option is nudged over the other.
Question 2: A company wants to implement data minimization in its CRM. Which technical control best achieves this?
- Encrypting all fields in the database
- Collecting only fields required for the stated purpose and purging unused fields (Correct answer)
- Backing up all data to an off-site location
- Applying role-based access control to restrict who can view records
Correct answer: Collecting only fields required for the stated purpose and purging unused fields
Data minimization means only collecting and retaining fields actually necessary for the processing purpose.
Question 3: Under GDPR Article 25, which approach satisfies 'data protection by default'?
- Enabling all optional data-sharing features unless the user opts out
- Setting privacy-protective options as the system default without user action (Correct answer)
- Providing users a dashboard to configure their own privacy settings
- Storing personal data in encrypted form at rest
Correct answer: Setting privacy-protective options as the system default without user action
Data protection by default means only necessary data is processed and privacy-protective settings apply automatically without requiring any user action.
Question 4: An organization implements pseudonymization for its analytics pipeline. Which statement correctly describes its GDPR status?
- Pseudonymized data is fully anonymous and falls outside GDPR scope
- Pseudonymization reduces risk but the data remains personal data if re-identification is possible (Correct answer)
- GDPR prohibits pseudonymization because it can be reversed
- Pseudonymized data requires explicit consent for all processing activities
Correct answer: Pseudonymization reduces risk but the data remains personal data if re-identification is possible
Pseudonymization is a security measure that lowers risk, but data remains personal data because re-identification with the key is still possible.
Question 5: When configuring retention schedules in a document management system, what must the technical implementation include to meet GDPR requirements?
- Manual deletion of records only when a data subject requests erasure
- Automated expiry workflows that delete or anonymize data when the retention period ends (Correct answer)
- Indefinite archiving of all records for audit purposes
- Transferring expired records to a third-party cold-storage provider
Correct answer: Automated expiry workflows that delete or anonymize data when the retention period ends
Automated retention workflows ensure data is not kept longer than necessary, fulfilling the storage limitation principle.
Question 6: A healthcare app logs every API call including patient identifiers. What GDPR-compliant configuration change should be made?
- Move logs to an encrypted S3 bucket
- Replace patient identifiers in logs with pseudonymous tokens or hash values (Correct answer)
- Delete all application logs immediately after each session
- Require separate consent before writing any log entries
Correct answer: Replace patient identifiers in logs with pseudonymous tokens or hash values
Replacing direct identifiers with pseudonymous tokens in logs reduces exposure while preserving the ability to debug issues.
Question 7: Which technical measure is specifically required when implementing a GDPR-compliant data subject access request (DSAR) portal?
- Charging a fee for each request to discourage abuse
- Verifying the requester's identity before disclosing personal data (Correct answer)
- Responding only to requests submitted via certified mail
- Limiting DSAR responses to data collected in the last 12 months
Correct answer: Verifying the requester's identity before disclosing personal data
Identity verification is essential before responding to a DSAR to prevent unauthorized disclosure of another person's data.
GDPR Implementation & Configuration 2
When configuring a cookie consent banner under GDPR, which technical requirement ensures consent is freely given?