GDPR Troubleshooting & Problem Resolution 2

Question 1

A data subject submits a Subject Access Request (SAR) but fails to specify which processing activities they are inquiring about. What is the controller's correct first step?

Accepted Answer

Respond within one month covering all personal data held

Answer

Under GDPR Article 12(3), the one-month response clock begins at receipt of the request; controllers must respond to all personal data held even if the request is vague.

Question 2

An employee inadvertently emails a spreadsheet containing 500 customers' health data to a wrong recipient outside the organization. How should this be classified?

Accepted Answer

A personal data breach requiring assessment for supervisory authority notification

Answer

Unauthorized disclosure of special-category data constitutes a personal data breach under Article 4(12), triggering the 72-hour notification assessment under Article 33.

Question 3

A controller discovers that its cookie consent banner never recorded opt-ins due to a technical bug running for six months. What is the primary compliance failure?

Accepted Answer

Lack of valid consent making all consent-based processing unlawful

Answer

Without a recorded opt-in, consent under Article 7 cannot be demonstrated, rendering any processing that relied on it unlawful from the start.

Question 4

A third-party processor notifies your organization of a breach affecting your data 96 hours after discovery. Which obligation has been violated?

Accepted Answer

The processor's duty to notify the controller 'without undue delay' under Article 33(2)

Answer

Article 33(2) requires processors to notify the controller without undue delay after becoming aware of a breach, independent of the controller's own 72-hour clock.

Question 5

During a DPIA, the project team identifies a residual high risk that cannot be mitigated to an acceptable level. What must the controller do?

Accepted Answer

Consult the supervisory authority prior to commencing processing under Article 36

Answer

Article 36(1) mandates prior consultation with the supervisory authority when a DPIA reveals a high residual risk that the controller cannot mitigate.

(GDPR) Certified General Data Protection Regulation Specialist Practice Test

(GDPR) Certified General Data Protection Regulation Specialist Practice Test

GDPR Troubleshooting & Problem Resolution 2