GDPR Implementation & Configuration 3

Question 1

An e-commerce platform stores EU customer payment data on servers in the United States. Which mechanism legally permits this under GDPR Chapter V?

Accepted Answer

Using Standard Contractual Clauses (SCCs) approved by the European Commission

Answer

SCCs are a recognized transfer mechanism under GDPR Article 46 that provide appropriate safeguards for international data transfers.

Question 2

When configuring role-based access control (RBAC) for a system holding personal data, which GDPR principle directly drives the principle of least privilege?

Accepted Answer

Data minimization and integrity & confidentiality

Answer

Least-privilege access reduces the volume of data any one user can access (minimization) and protects confidentiality (integrity & confidentiality principle under Article 5(1)(f)).

Question 3

A processor wants to engage a sub-processor for cloud hosting. Under GDPR Article 28, what contractual step is mandatory?

Accepted Answer

The processor must obtain prior written authorization from the controller

Answer

Article 28(2) requires processors to obtain prior specific or general written authorization from the controller before engaging sub-processors.

Question 4

During a DPIA for a new facial recognition system, the project team identifies a high residual risk that cannot be mitigated. What must happen next?

Accepted Answer

The controller must consult the supervisory authority before proceeding

Answer

Article 36 requires prior consultation with the supervisory authority when a DPIA reveals a high residual risk that the controller cannot mitigate.

Question 5

An organization's mobile app uses device fingerprinting to track users across sessions without cookies. Under GDPR, which legal basis is most appropriate if the purpose is behavioral advertising?

Accepted Answer

Consent, because behavioral advertising is not necessary for the service

Answer

Behavioral advertising is not necessary for the core service, so it cannot rely on contract or legitimate interests — explicit consent is required.

(GDPR) Certified General Data Protection Regulation Specialist Practice Test

(GDPR) Certified General Data Protection Regulation Specialist Practice Test

GDPR Implementation & Configuration 3