GDPR Specialist Principles and Concepts 3

Question 1

Under GDPR, when is a Data Protection Impact Assessment (DPIA) mandatory?

Accepted Answer

When processing is likely to result in a high risk to the rights and freedoms of natural persons

Answer

Article 35 mandates a DPIA when processing is likely to result in a high risk to individuals' rights and freedoms, particularly for new technologies or large-scale profiling.

Question 2

Which of the following organizations is NOT required to designate a Data Protection Officer (DPO) under Article 37 GDPR?

Accepted Answer

A small retailer processing employee payroll data only

Answer

A small retailer processing employee payroll incidentally does not meet the Article 37 thresholds (public authority, large-scale monitoring, or large-scale special category processing).

Question 3

GDPR's 'right to erasure' (Article 17) is absolute in all circumstances.

Accepted Answer

False — it is subject to exceptions including legal obligations and public interest tasks

Answer

Article 17 provides the right to erasure but includes exceptions for legal obligations, public interest, archiving purposes, and legal claims.

Question 4

A controller relies on 'legitimate interests' as the lawful basis for processing. What additional balancing test must be satisfied?

Accepted Answer

The legitimate interest must not be overridden by the data subject's interests or rights

Answer

Article 6(1)(f) requires that the controller's legitimate interests are not overridden by the interests, rights, or freedoms of the data subject — the three-part LIA test.

Question 5

What is the role of the 'lead supervisory authority' under GDPR's One-Stop-Shop mechanism?

Accepted Answer

It is the supervisory authority of the member state where the controller has its main establishment

Answer

The lead supervisory authority is determined by the location of the controller's or processor's main establishment, serving as the primary regulatory contact for cross-border processing.

(GDPR) Certified General Data Protection Regulation Specialist Practice Test

(GDPR) Certified General Data Protection Regulation Specialist Practice Test

GDPR Specialist Principles and Concepts 3