Free BCS Foundation Certificate in Data Protection Practice Questions

Sample Practice Questions

Try these 10 sample questions from the BCS Foundation Certificate in Data Protection practice bank. Each includes the answer and explanation. Continue with the interactive practice above to review the full question set.

1. 1A US company has a UK branch whose personnel records are processed in the United States as part of that branch's activities. Which UK GDPR territorial test applies to this processing?

   1. A.The establishment testCorrect answer: A
   2. B.The goods-and-services targeting test
   3. C.The behavioural monitoring test
   4. D.The public international law test

   Explanation: Article 3(1) covers processing in the context of a UK establishment's activities "regardless of whether the processing takes place" there. The US processing relates to the UK branch; the facts do not describe targeting, behavioural monitoring or a place subject to UK law through public international law.

   Reference: United Kingdom General Data Protection Regulation, Article 3 — Article 3(1)–(3)

2. 2A privacy team reviews a customer intake form for a legally authorised purpose and removes personal data fields that are not needed for that purpose. Which data protection principle does this decision primarily implement?

   1. A.Data accuracy
   2. B.Data minimisationCorrect answer: B
   3. C.Storage limitation
   4. D.Integrity and confidentiality

   Explanation: NIST defines minimization as limiting collection of personal information to activities that are "directly relevant and necessary to accomplish a legally authorized purpose". Removing unnecessary fields applies that collection principle to the form.

   Reference: NIST Computer Security Resource Center: Minimization — Definitions

3. 3To ship a purchase, a US retailer subject to the UK GDPR needs a UK customer's delivery address solely to fulfil their contract. Which Article 6 basis most directly fits this processing?

   1. A.Vital interests
   2. B.Public task
   3. C.ContractCorrect answer: C
   4. D.Consent

   Explanation: The BCS syllabus says that contractual processing applies "only where the processing is part of the contract". The address is needed to deliver the contracted purchase; the facts describe neither an emergency, a public task nor consent.

   Reference: BCS Foundation Certificate in Data Protection v3.9 Syllabus 1.0 — Section 3.1, guidance

4. 4When planning a customer database, a US controller subject to the UK GDPR must follow data protection by design. When must it first build safeguards into the processing?

   1. A.When deciding how the processing will be carried outCorrect answer: A
   2. B.When the first customer record has been collected
   3. C.When the first internal user requests data access
   4. D.When the first transfer of customer data occurs

   Explanation: Article 25(1) requires measures both "at the time of the determination of the means for processing" and when processing occurs. The controller must address safeguards while deciding how the database will process data.

   Reference: United Kingdom General Data Protection Regulation, Article 25 — Article 25(1)

5. 5Before engaging another processor, a US processor subject to the UK GDPR needs prior specific or general written authorisation under Article 28. Whose authorisation is required?

   1. A.The controller'sCorrect answer: A
   2. B.The data subject's
   3. C.The supervisory authority's
   4. D.The data protection officer's

   Explanation: Article 28 states that a processor must not engage another processor without "prior specific or general written authorisation of the controller". The controller, rather than the other parties listed, gives this authorisation.

   Reference: United Kingdom General Data Protection Regulation, Article 28 — Article 28(2)

6. 6A US-headquartered group has a UK establishment and initiates a transfer of personal data under the UK GDPR. Which recipient makes this a restricted transfer under the ICO's three-step test?

   1. A.A separately incorporated subsidiary located in the USCorrect answer: A
   2. B.An unincorporated branch of the same entity located in the US
   3. C.A separately incorporated subsidiary located in the UK
   4. D.An unincorporated branch of the same entity located in the UK

   Explanation: The ICO's test asks whether the recipient is "an organisation located outside the UK" and whether it is "a separate legal entity". The separately incorporated US subsidiary meets both conditions; the other recipients fail at least one of them.

   Reference: ICO: A Brief Guide to International Transfers — Are we making a restricted transfer? Steps 2 and 3

7. 7A UK customer asks a US controller subject to the UK GDPR for the personal data they provided in a machine-readable format so they can move it to another provider. Processing is automated and based on their contract. Which right is the customer exercising?

   1. A.The right to rectification
   2. B.The right to data portabilityCorrect answer: B
   3. C.The right to restriction
   4. D.The right to object

   Explanation: Article 20 gives the individual a right to receive provided data in a "structured, commonly used and machine-readable format" and transmit it to another controller where processing is automated and based on consent or contract. Those conditions are stated in the scenario.

   Reference: United Kingdom General Data Protection Regulation, Article 20 — Article 20(1) and (1)(a)–(b)

8. 8An EU supervisory authority orders a US controller subject to the EU GDPR to provide information needed for the authority's duties. Under Article 58, which category of power is the authority exercising?

   1. A.Investigative powerCorrect answer: A
   2. B.Corrective power
   3. C.Authorisation power
   4. D.Advisory power

   Explanation: Article 58(1) lists "investigative powers" and includes an order to the controller or processor to provide information required for the authority's tasks. The request described is an exercise of that power.

   Reference: Regulation (EU) 2016/679, General Data Protection Regulation — Article 58(1)(a)

9. 9While acting for a controller, a US processor subject to the UK GDPR becomes aware of a personal data breach. Under Article 33, whom must it notify without undue delay?

   1. A.The controllerCorrect answer: A
   2. B.The supervisory authority
   3. C.The data subject
   4. D.The data protection officer

   Explanation: Article 33(2) states: "The processor shall notify the controller without undue delay after becoming aware of a personal data breach." The separate duties to notify the authority or individuals apply under their own conditions.

   Reference: United Kingdom General Data Protection Regulation, Article 33 — Article 33(2)

10. 10A US privacy adviser is reviewing a UK charity's use of the PECR charitable-purposes soft opt-in. Assuming all other conditions are met, what is the earliest date on which the charity may have obtained the recipient's contact details for this opt-in?

    1. A.1 January 2021
    2. B.19 June 2025
    3. C.5 February 2026Correct answer: C
    4. D.30 September 2026

    Explanation: The ICO states that "The charitable purposes soft opt-in commenced on 5 February 2026" and "You must only use it if you obtained the recipient’s contact details on or after this date." Earlier collection does not qualify for this opt-in.

    Reference: ICO: How to Comply with the PECR Electronic Mail Marketing Rules — How do we use the charitable purposes soft opt-in? — obtaining contact details