GDPR Performance Optimization 3

Question 1

A GDPR-regulated SaaS platform stores user data in multiple EU regions for performance reasons. What must be documented to remain compliant?

Accepted Answer

All storage locations must be listed in the Records of Processing Activities (RoPA)

Answer

Article 30 requires the RoPA to document all locations where personal data is stored or processed, including multiple EU regions used for performance.

Question 2

To optimize GDPR data retention workflows, an organization automates deletion of records past their retention period. Which safeguard is most critical for this automation?

Accepted Answer

Both B and C

Answer

Automated deletion must be logged to satisfy accountability, and records under legal hold must be excluded to avoid destroying evidence or breaching other legal obligations.

Question 3

An organization wants to speed up GDPR impact assessments (DPIAs) by reusing previous assessments. When is reuse appropriate under GDPR?

Accepted Answer

Reuse is appropriate only when processing operations and risks are substantially similar

Answer

Recital 92 allows similar processing operations to be covered by a single DPIA, making reuse valid when the nature, scope, context, and risks are substantially the same.

Question 4

Which database design choice most efficiently supports GDPR's storage limitation principle while optimizing query performance for active records?

Accepted Answer

Separate active and archived records into hot/cold tiers with automated archival policies

Answer

Hot/cold tiering keeps frequently accessed active records fast to query while automated archival enforces storage limitation by moving or deleting data past its retention period.

Question 5

A consent management platform (CMP) must record granular consent with timestamps at high throughput. Which storage approach best handles write-heavy consent logging under GDPR?

Accepted Answer

Use an append-only event log (e.g., Kafka-backed) with periodic compaction to a consent store

Answer

An append-only event log absorbs high write throughput efficiently and provides an immutable audit trail, while compaction builds the current consent state for reads.

(GDPR) Certified General Data Protection Regulation Specialist Practice Test

(GDPR) Certified General Data Protection Regulation Specialist Practice Test

GDPR Performance Optimization 3