GDPR Specialist Principles and Concepts 5

Question 1

A data subject submits a Subject Access Request (SAR) to a controller. What is the standard deadline for the controller to respond?

Accepted Answer

30 days

Answer

Article 12(3) requires controllers to respond to a SAR within one month (approximately 30 days) of receipt, extendable by two more months for complex or numerous requests.

Question 2

What does the GDPR 'right to restriction of processing' allow a data subject to do?

Accepted Answer

Prevent their data from being processed in certain circumstances while it remains stored

Answer

Article 18 allows data subjects to restrict processing — meaning the data is stored but not further used — in specific circumstances such as contested accuracy or unlawful processing.

Question 3

Under GDPR, which scenario would require prior consultation with the supervisory authority before processing begins?

Accepted Answer

Processing that a DPIA indicates poses a high residual risk that the controller cannot mitigate

Answer

Article 36 mandates prior consultation with the supervisory authority when a DPIA reveals a high residual risk that cannot be adequately mitigated by the controller.

Question 4

A controller in France processes data of customers in Germany and Spain. Which supervisory authority is the lead authority under the One-Stop-Shop mechanism?

Accepted Answer

France's CNIL, as the controller's main establishment is in France

Answer

Under Article 56, the lead supervisory authority is determined by the location of the controller's main establishment — France in this case, making the CNIL the lead authority.

Question 5

Under GDPR Article 28, which requirement must a data processing agreement between controller and processor include?

Accepted Answer

The processor must process data only on documented instructions of the controller

Answer

Article 28(3)(a) requires processors to process personal data only on the controller's documented instructions, which must be stipulated in the binding data processing agreement.

(GDPR) Certified General Data Protection Regulation Specialist Practice Test

(GDPR) Certified General Data Protection Regulation Specialist Practice Test

GDPR Specialist Principles and Concepts 5