GDPR Specialist Obligations of Data Controllers and Processors 2

Question 1

Under GDPR Article 28, which of the following must be included in a Data Processing Agreement (DPA) between a controller and processor?

Accepted Answer

Provisions requiring the processor to assist the controller in fulfilling data subject rights requests

Answer

Article 28 requires DPAs to include provisions where the processor assists the controller in responding to data subject rights requests.

Question 2

A processor engages a sub-processor without prior written authorization from the controller. Under GDPR, what is the consequence?

Accepted Answer

The processor remains fully liable to the controller for the sub-processor's acts and omissions

Answer

Article 28(4) states that where a processor engages a sub-processor, the original processor remains fully liable to the controller for the sub-processor's performance.

Question 3

Which GDPR article specifically addresses the records of processing activities that processors must maintain?

Accepted Answer

Article 30

Answer

Article 30 requires both controllers and processors to maintain records of processing activities under their responsibility.

Question 4

A controller instructs a processor to delete all personal data after a contract ends, but the processor believes retention is required by EU law. What should the processor do?

Accepted Answer

Inform the controller of the legal retention requirement before taking action

Answer

Article 28(3)(a) requires processors to process data only on documented instructions, but they must inform the controller if an instruction infringes applicable law.

Question 5

Under GDPR, what is the primary distinction between a data controller and a data processor?

Accepted Answer

Controllers determine the purposes and means of processing; processors process on behalf of the controller

Answer

A controller determines why and how personal data is processed, while a processor acts on the controller's behalf under their instructions.

(GDPR) Certified General Data Protection Regulation Specialist Practice Test

(GDPR) Certified General Data Protection Regulation Specialist Practice Test

GDPR Specialist Obligations of Data Controllers and Processors 2