GDPR Security & Access Management 3

Question 1

A healthcare organisation transfers patient records to a cloud provider. Under GDPR, which contractual clause is MANDATORY regarding security?

Accepted Answer

The processor must process data only on controller instructions and implement Article 32 security measures

Answer

Article 28(3) mandates that processor agreements include requirements to follow controller instructions and implement appropriate security under Article 32.

Question 2

What does 'privacy by default' require specifically regarding access to personal data systems?

Accepted Answer

Systems must default to the most privacy-protective settings, limiting access to what is necessary

Answer

Article 25(2) requires that by default, only personal data necessary for each specific purpose is processed, including limiting access scope.

Question 3

An attacker gains access to a database by exploiting an unpatched vulnerability and exfiltrates 50,000 customer records. Under GDPR, what is the maximum administrative fine the controller could face?

Accepted Answer

€20 million or 4% of global annual turnover, whichever is higher

Answer

Failure to implement appropriate security under Article 32 falls under Article 83(4), but serious breaches of core principles can reach €20M/4% under Article 83(5).

Question 4

Which access management approach aligns best with GDPR's principle of data minimisation for system administrators?

Accepted Answer

Providing admins access only to the specific systems and data required for their duties

Answer

Least-privilege access for administrators ensures they can only access what is necessary for their role, directly implementing data minimisation.

Question 5

Under GDPR, a data breach notification to the supervisory authority must be made within what timeframe after the controller becomes aware of it?

Accepted Answer

72 hours

Answer

Article 33(1) requires notification to the supervisory authority within 72 hours of the controller becoming aware of the breach, where feasible.

(GDPR) Certified General Data Protection Regulation Specialist Practice Test

(GDPR) Certified General Data Protection Regulation Specialist Practice Test

GDPR Security & Access Management 3